Relative Path Overwrite (RPO) Affecting io.springfox:springfox-swagger-ui package, versions [,2.10.0)


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of concept
EPSS
1.36% (86th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-JAVA-IOSPRINGFOX-1075064
  • published11 Oct 2019
  • disclosed10 Oct 2019
  • creditcrazykid95

Introduced: 10 Oct 2019

CVE-2019-17495  (opens in a new tab)
CWE-94  (opens in a new tab)

How to fix?

Upgrade io.springfox:springfox-swagger-ui to version 2.10.0 or higher.

Overview

io.springfox:springfox-swagger-ui is an Automated JSON API documentation for API's built with Spring

Affected versions of this package are vulnerable to Relative Path Overwrite (RPO). Attackers are able to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value i.e. allows the embedding of untrusted JSON data from remote servers, using <style>@import within the JSON data.

CVSS Scores

version 3.1