CVE-2016-5682

EPSS 0.28%

Cross-Site Scripting in swagger-ui

發布日:2020/9/1修改日:2023/11/8

描述

Affected versions of `swagger-ui` contain a cross-site scripting vulnerability in the key names of a specific nested object in the JSON document. ## Proof of Concept The vulnerable object structure is: ``` { "definitions": { "arbitraryVal": { "properties": { "<INJECTABLE_KEY_NAME>": "LoremIpsum" } } } } ``` Malicious JSON documents can be loaded in by providing a URL to them in the `url` query string parameter. ## Recommendation Update to version 2.2.1 or later.

受影響套件(1)

參考連結(5)