WS-2019-0172 (Medium) detected in swagger-ui-2.2.10.tgz

[mend-bolt-for-github]

WS-2019-0172 - Medium Severity Vulnerability

Vulnerable Library - swagger-ui-2.2.10.tgz

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-2.2.10.tgz

Path to dependency file: /tmp/ws-scm/cesium-coreui-react/backend/package.json

Path to vulnerable library: /tmp/ws-scm/cesium-coreui-react/backend/node_modules/loopback-component-explorer/node_modules/swagger-ui/package.json

Dependency Hierarchy:

• loopback-component-explorer-6.4.0.tgz (Root Library)
  • ❌ swagger-ui-2.2.10.tgz (Vulnerable Library)

Found in HEAD commit: 8c766291aacf616f0f787849563a1a20989f6c61

Vulnerability Details

swagger-ui before 3.20.9 fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript. that leads to Cross-Site Scripting

Publish Date: 2019-07-15

URL: WS-2019-0172

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/976

Release Date: 2019-07-15

Fix Resolution: 3.20.9

---

Step up your Open Source Security Game with WhiteSource here