swagger-ui-3.2.2.tgz: 26 vulnerabilities (highest severity is: 9.8) #1
Labels
Mend: dependency security vulnerability
Security vulnerability detected by Mend
Comments
dev-mend-for-github-com
bot
added
the
Mend: dependency security vulnerability
dev-mend-for-github-com
bot
changed the title
dev-mend-for-github-com
bot
changed the title
dev-mend-for-github-com
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
[](http://badge.fury.io/js/swagger-ui)
Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-3.2.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/swagger-ui/package.json
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - parseurl-1.3.3.tgz
parse a url with memoization
Library home page: https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parseurl/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
Created automatically by the test suite
Publish Date: 2010-06-07
URL: CVE-616547-419802
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Vulnerable Library - loader-utils-0.2.17.tgz
utils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-0.2.17.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/worker-loader/node_modules/loader-utils/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.
Publish Date: 2022-10-12
URL: CVE-2022-37601
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-76p3-8jx3-jpfq
Release Date: 2022-10-12
Fix Resolution (loader-utils): 1.4.1
Direct dependency fix Resolution (swagger-ui): 3.17.2
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - swagger-ui-3.2.2.tgz
[](http://badge.fury.io/js/swagger-ui)
Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-3.2.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/swagger-ui/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.
Publish Date: 2019-10-10
URL: CVE-2019-17495
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17495
Release Date: 2019-10-10
Fix Resolution: 3.23.11
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - lodash-4.17.2.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Publish Date: 2019-07-25
URL: CVE-2019-10744
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-jf85-cpcp-j695
Release Date: 2019-07-26
Fix Resolution (lodash): 4.17.12
Direct dependency fix Resolution (swagger-ui): 3.17.2
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Libraries - braces-2.3.2.tgz, braces-1.8.5.tgz
braces-2.3.2.tgz
Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.
Library home page: https://registry.npmjs.org/braces/-/braces-2.3.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/webpack-dev-server/node_modules/braces/package.json
Dependency Hierarchy:
braces-1.8.5.tgz
Fastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.
Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/micromatch/node_modules/braces/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
The NPM package
braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. Inlib/parse.js,if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.Publish Date: 2024-05-13
URL: CVE-2024-4068
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2024-05-13
Fix Resolution: braces - 3.0.3
Vulnerable Library - trim-newlines-1.0.0.tgz
Trim newlines from the start and/or end of a string
Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-1.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/trim-newlines/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
Publish Date: 2021-05-28
URL: CVE-2021-33623
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623
Release Date: 2021-05-28
Fix Resolution (trim-newlines): 3.0.1
Direct dependency fix Resolution (swagger-ui): 3.19.5
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - webpack-dev-server-2.5.0.tgz
Serves a webpack app. Updates the browser on changes.
Library home page: https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-2.5.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/webpack-dev-server/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.
Publish Date: 2018-09-21
URL: CVE-2018-14732
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-14732
Release Date: 2018-09-21
Fix Resolution (webpack-dev-server): 3.1.6
Direct dependency fix Resolution (swagger-ui): 3.19.5
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - lodash-4.17.2.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
Publish Date: 2020-07-15
URL: CVE-2020-8203
CVSS 3 Score Details (7.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1523
Release Date: 2020-07-15
Fix Resolution (lodash): 4.17.9
Direct dependency fix Resolution (swagger-ui): 3.17.2
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - deep-extend-0.4.1.tgz
Recursive object extending
Library home page: https://registry.npmjs.org/deep-extend/-/deep-extend-0.4.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/deep-extend/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Publish Date: 2018-05-24
URL: CVE-2018-3750
CVSS 3 Score Details (7.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3750
Release Date: 2018-07-03
Fix Resolution (deep-extend): 0.5.1
Direct dependency fix Resolution (swagger-ui): 3.14.2
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - lodash-4.17.2.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Publish Date: 2021-02-15
URL: CVE-2021-23337
CVSS 3 Score Details (7.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-35jh-r3h4-6jhm
Release Date: 2021-02-15
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (swagger-ui): 3.17.2
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - json5-0.5.1.tgz
JSON for the ES5 era.
Library home page: https://registry.npmjs.org/json5/-/json5-0.5.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/worker-loader/node_modules/json5/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The
parsemethod of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named__proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned byJSON5.parseand not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned fromJSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution.JSON5.parseshould restrict parsing of__proto__keys when parsing JSON strings to objects. As a point of reference, theJSON.parsemethod included in JavaScript ignores__proto__keys. Simply changingJSON5.parsetoJSON.parsein the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.Publish Date: 2022-12-24
URL: CVE-2022-46175
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175
Release Date: 2022-12-24
Fix Resolution (json5): 1.0.2
Direct dependency fix Resolution (swagger-ui): 3.17.2
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - swagger-ui-3.2.2.tgz
[](http://badge.fury.io/js/swagger-ui)
Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-3.2.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/swagger-ui/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
swagger-ui before 3.20.9 fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript. that leads to Cross-Site Scripting
Publish Date: 2019-02-23
URL: WS-2019-0172
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/976
Release Date: 2019-02-23
Fix Resolution: 3.20.9
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - lodash-4.17.2.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.
Publish Date: 2019-07-17
URL: CVE-2019-1010266
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2019-07-17
Fix Resolution (lodash): 4.17.11
Direct dependency fix Resolution (swagger-ui): 3.17.2
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - lodash-4.17.2.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.
Mend Note: Converted from WS-2019-0184, on 2022-11-08.
Publish Date: 2018-04-26
URL: CVE-2018-3721
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1067
Release Date: 2018-06-07
Fix Resolution (lodash): 4.17.5
Direct dependency fix Resolution (swagger-ui): 3.11.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - autolinker-0.28.1.tgz
Utility to automatically link the URLs, email addresses, and Twitter handles in a given block of text/HTML
Library home page: https://registry.npmjs.org/autolinker/-/autolinker-0.28.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/autolinker/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
Cross-site Scripting (XSS) vulnerability was found in autolinker before 3.14.0. User input passed to the innerHTML tags isn't sanitized.
Publish Date: 2017-02-15
URL: WS-2017-3770
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2017-02-15
Fix Resolution (autolinker): 3.14.0
Direct dependency fix Resolution (swagger-ui): 3.26.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - lodash-4.17.2.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
Publish Date: 2019-02-01
URL: CVE-2018-16487
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487
Release Date: 2019-02-01
Fix Resolution (lodash): 4.17.11
Direct dependency fix Resolution (swagger-ui): 3.17.2
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - swagger-ui-3.2.2.tgz
[](http://badge.fury.io/js/swagger-ui)
Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-3.2.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/swagger-ui/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
Swagger-ui before 3.18.0 is vulnerable to Reverse Tabnabbing. Setting target="_blank" on anchor tags is unsafe unless used in conjunction with the rel="noopener" attribute. Opening a link via target blank attribute can change the original page, origin policy restrictions set by the browser can be bypassed.
Publish Date: 2018-08-02
URL: WS-2018-0593
CVSS 3 Score Details (5.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2018-08-02
Fix Resolution: 3.18.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - autolinker-0.28.1.tgz
Utility to automatically link the URLs, email addresses, and Twitter handles in a given block of text/HTML
Library home page: https://registry.npmjs.org/autolinker/-/autolinker-0.28.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/autolinker/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
Denial of Service (DoS) vulnerability was found in autolinker before 3.0.0. Unterminated img src causes long execution.
Publish Date: 2019-01-08
URL: WS-2019-0540
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2019-01-08
Fix Resolution (autolinker): 3.0.0
Direct dependency fix Resolution (swagger-ui): 3.26.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - sanitize-html-1.27.5.tgz
Clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis
Library home page: https://registry.npmjs.org/sanitize-html/-/sanitize-html-1.27.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/sanitize-html/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\example.com".
Publish Date: 2021-02-08
URL: CVE-2021-26540
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26540
Release Date: 2021-02-08
Fix Resolution (sanitize-html): 2.3.2
Direct dependency fix Resolution (swagger-ui): 3.14.1
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - sanitize-html-1.27.5.tgz
Clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis
Library home page: https://registry.npmjs.org/sanitize-html/-/sanitize-html-1.27.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/sanitize-html/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.
Publish Date: 2021-02-08
URL: CVE-2021-26539
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26539
Release Date: 2021-02-08
Fix Resolution (sanitize-html): 2.3.1
Direct dependency fix Resolution (swagger-ui): 3.14.1
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - sockjs-0.3.18.tgz
SockJS-node is a server counterpart of SockJS-client a JavaScript library that provides a WebSocket-like object in the browser. SockJS gives you a coherent, cross-browser, Javascript API which creates a low latency, full duplex, cross-domain communication
Library home page: https://registry.npmjs.org/sockjs/-/sockjs-0.3.18.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/sockjs/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.
Publish Date: 2020-07-09
URL: CVE-2020-7693
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2020-07-14
Fix Resolution (sockjs): 0.3.20
Direct dependency fix Resolution (swagger-ui): 3.19.5
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - yargs-parser-4.2.1.tgz
the mighty option parser used by yargs
Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-4.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/yargs-parser/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.
Publish Date: 2020-03-16
URL: CVE-2020-7608
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2020-03-16
Fix Resolution (yargs-parser): 5.0.0-security.0
Direct dependency fix Resolution (swagger-ui): 3.19.5
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - lodash-4.17.2.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.
Publish Date: 2021-02-15
URL: CVE-2020-28500
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500
Release Date: 2021-02-15
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (swagger-ui): 3.17.2
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - swagger-ui-3.2.2.tgz
[](http://badge.fury.io/js/swagger-ui)
Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-3.2.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/swagger-ui/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
swagger-ui before 3.18.0 has Reverse Tabnapping vulnerability. using target='_blank' in anchor tags, allowing attackers to access window.opener for the original page.
Publish Date: 2018-08-02
URL: WS-2019-0171
CVSS 3 Score Details (4.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/975
Release Date: 2018-08-02
Fix Resolution: 3.18.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - node-fetch-1.7.3.tgz
A light-weight module that brings window.fetch to node.js and io.js
Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-1.7.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-fetch/package.json
Dependency Hierarchy:
Found in HEAD commit: 89d1d81dc833ee45673cd2de1f4dcdeb2dfd8b09
Found in base branch: main
Vulnerability Details
node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.
Publish Date: 2020-09-10
URL: CVE-2020-15168
CVSS 3 Score Details (2.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-w7rc-rwvf-8q5r
Release Date: 2020-09-17
Fix Resolution (node-fetch): 2.6.1
Direct dependency fix Resolution (swagger-ui): 3.38.0
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: