CVE-2019-17495: oracle banking_apis Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2019-17495 is a critical (CVSS 9.8) Cross-Site Request Forgery (CSRF) vulnerability in oracle banking_apis. EPSS estimates a 5.73% chance of exploitation in the next 30 days, higher than 92.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-10-2019
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.