CVE-2019-17495

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-10-10 · updated 2026-06-17
Weakness: CWE-352

Description

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.

Affected products

Oracle Banking Apis: from 18.1 through 18.3; 19.1, 19.2, 20.1, 21.1
Oracle Corporation Banking Digital Experience: from 18.1 through 18.3; 19.1, 19.2, 20.1, 21.1
Oracle Banking Platform: from 2.4.0 through 2.10.0
Oracle Corporation Primavera Gateway: from 16.2.0 through 16.2.11; from 17.12.0 through 17.12.8
Oracle Corporation Utilities Framework: 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0
fastify-swagger-ui: before 3.23.11 — fixed in 3.23.11

How to fix

Upgrade to a fixed version: fastify-swagger-ui 3.23.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-17495 or the next vulnerability affects your stack