CVE-2016-5682
Cross-Site Scripting in swagger-ui
EPSS 1.0%
描述
Affected versions of `swagger-ui` contain a cross-site scripting vulnerability in the key names of a specific nested object in the JSON document. ## Proof of Concept The vulnerable object structure is: ``` { "definitions": { "arbitraryVal": { "properties": { "<INJECTABLE_KEY_NAME>": "LoremIpsum" } } } } ``` Malicious JSON documents can be loaded in by providing a URL to them in the `url` query string parameter. ## Recommendation Update to version 2.2.1 or later.
如何修補 CVE-2016-5682
要修補 CVE-2016-5682,請將受影響套件升級到下列已修補版本。
- —升級至 2.2.1 或更新版本
CVE-2016-5682 正在被利用嗎?
低 — EPSS 為 1.0%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 2.2.1