A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to
    use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such
    as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of
    untrusted JSON data from remote servers, but it was not previously known that <style>@import within the
    JSON data was a functional attack method. (CVE-2019-17495)

The version of Primavera Gateway installed on the remote host is affected by a vulnerability as referenced in the October 2020 CPU advisory.

Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Swagger UI)).
Supported versions that are affected are 16.2.0-16.2.11 and 17.12.0-17.12.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway. Successful attacks of this vulnerability can result in takeover of Primavera Gateway.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
422979	SCA: security update for io.springfox:springfox-swagger-ui, org.webjars.npm:swagger-ui, org.webjars:swagger-ui, swagger-ui (GHSA-c427-hjc3-wrfw)	Tenable Cloud Security	SCA Checks	Local	critical
422979	SCA: security update for io.springfox:springfox-swagger-ui, org.webjars.npm:swagger-ui, org.webjars:swagger-ui, swagger-ui (GHSA-c427-hjc3-wrfw)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
141785	Oracle Primavera Gateway (Oct 2020 CPU)	Nessus	CGI abuses	Remote	critical

Detections

Analytics

CVE-2019-17495

critical

Tenable Plugins

critical

critical

critical