CVE-2016-1000233

priority · track · 0US

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

— EPSS

no CVSS

Is it mine?

1 products

Who says so?

1 sources

osv

No description recorded.

cvss

Technical severity, 0–10. One row per scoring source.

No CVSS score recorded.

The CWE weakness classes this flaw belongs to.

Products and version ranges known to be affected.

Vendor and ecosystem advisories describing this.

GHSA-mrx7-8hxf-f853Cross-Site Scripting in swagger-ui2020-09-01ghsa · osvUS
Affected versions of `swagger-ui` are vulnerable to cross-site scripting. This vulnerability exists because `swagger-ui` automatically executes external Javascript that is loaded in via the `url` query string parameter when a `Content-Type: application/javascript` header is included. An attacker can create a server that replies with a malicious script and the proper content-type, and then craft a `swagger-ui` URL that includes the location to their server/script in the `url` query string parameter. When viewed, such a link would execute the attacker's malicious script. ## Recommendation Update to 2.2.1 or later.

Which sources assert this record, and when.

published —modified —

External citations — patches, advisories, analysis.

No references recorded.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.