Reverse Tabnabbing Affecting swagger-ui package, versions <3.18.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-SWAGGERUI-449808
- published 13 Jun 2019
- disclosed 4 Aug 2018
- credit Unknown
How to fix?
Upgrade swagger-ui to version 3.18.0 or higher.
Overview
swagger-ui is a library that allows interaction and visualisation of APIs.
Affected versions of this package are vulnerable to Reverse Tabnabbing. Setting target="_blank" on anchor tags is unsafe unless used in conjunction with the rel="noopener" attribute. A link opened via target blank attribute can make changes to the original page, essentially bypassing same origin policy restrictions set by the browser.
References
CVSS Scores
version 3.1