CVE:CVE-2019-17495
CNNVD:CNNVD-201910-715
Swagger UI是一款支持可视化API资源并能够与之进行交互的开源工具。
Swagger UI 3.23.11之前版本中存在跨站请求伪造漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。
solution:Upgrade smartbear swagger_ui to a higher version than 3.23.11,and avoid the version (,3.23.11); Upgrade oracle banking_apis to a higher version than 18.3,19.1,19.2,20.1,21.1,and avoid the version [18.1,18.3],19.1,19.2,20.1,21.1; Upgrade oracle banking_digital_experience to a higher version than 18.3,19.1,19.2,20.1,21.1,and avoid the version [18.1,18.3],19.1,19.2,20.1,21.1; Upgrade oracle banking_platform to a higher version than 2.10.0,and avoid the version [2.4.0,2.10.0]; Upgrade oracle primavera_gateway to a higher version than 16.2.11,17.12.8,and avoid the version [16.2.0,16.2.11],[17.12.0,17.12.8]; Upgrade oracle utilities_framework to a higher version than 4.3.0.6.0,4.4.0.0.0,4.4.0.2.0,and avoid the version 4.3.0.6.0,4.4.0.0.0,4.4.0.2.0