WS-2019-0171 (Medium) detected in swagger-ui-2.2.10.tgz

[mend-bolt-for-github]

WS-2019-0171 - Medium Severity Vulnerability

Vulnerable Library - swagger-ui-2.2.10.tgz

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-2.2.10.tgz

Path to dependency file: /tmp/ws-scm/cesium-coreui-react/backend/package.json

Path to vulnerable library: /tmp/ws-scm/cesium-coreui-react/backend/node_modules/loopback-component-explorer/node_modules/swagger-ui/package.json

Dependency Hierarchy:

• loopback-component-explorer-6.4.0.tgz (Root Library)
  • ❌ swagger-ui-2.2.10.tgz (Vulnerable Library)

Found in HEAD commit: 8c766291aacf616f0f787849563a1a20989f6c61

Vulnerability Details

swagger-ui before 3.18.0 has Reverse Tabnapping vulnerability. using target='_blank' in anchor tags, allowing attackers to access window.opener for the original page.

Publish Date: 2019-07-15

URL: WS-2019-0171

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/975

Release Date: 2019-07-15

Fix Resolution: 3.18.0

---

Step up your Open Source Security Game with WhiteSource here