A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI prior to 3.23.11 allows malicious users to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
smartbear swagger ui |
||
oracle banking apis |
||
oracle banking apis 19.1 |
||
oracle banking apis 19.2 |
||
oracle banking apis 20.1 |
||
oracle banking apis 21.1 |
||
oracle banking digital experience |
||
oracle banking digital experience 19.1 |
||
oracle banking digital experience 19.2 |
||
oracle banking digital experience 20.1 |
||
oracle banking digital experience 21.1 |
||
oracle banking platform |
||
oracle primavera gateway |
||
oracle utilities framework 4.3.0.6.0 |
||
oracle utilities framework 4.4.0.0.0 |
||
oracle utilities framework 4.4.0.2.0 |
Vulmon