[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjlenbh0eqFNjUBkT-hw4wJqVSIbz2gF2HZC7lnWjt-E":3,"g5a-risk:CVE-2019-17495":242},{"success":4,"data":5,"meta":240},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":39,"epssPercentile":27,"epssTimeSeries":40,"severity":41,"affectedProducts":42,"affectedProductsCount":91,"references":92,"referencesCount":133,"weaknesses":134,"weaknessesCount":143,"isActivelyExploited":144,"cisaInfo":27,"otxData":27,"relatedBlogPosts":145,"seoMetadata":146,"configurations":171,"relatedVendorCves":224,"notableEvents":225},"CVE-2019-17495","What is CVE-2019-17495?","A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that @import within the JSON data was a functional attack method.","A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to pe...","2019-10-10T22:15:10.29","2023-11-07T03:06:18.463",9.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":27,"CVSSMetricV2":30,"CVSSMetricV40":27},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":28,"ImpactScore":29},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":25,"IntegrityImpact":25,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":26,"ExploitCodeMaturity":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"TemporalSeverity":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":25,"ModifiedAttackVector":27,"ModifiedAttackComplexity":27,"ModifiedPrivilegesRequired":27,"ModifiedUserInteraction":27,"ModifiedScope":27,"ModifiedConfidentialityImpact":27,"ModifiedIntegrityImpact":27,"ModifiedAvailabilityImpact":27,"EnvironmentalScore":27,"EnvironmentalSeverity":27},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH","CRITICAL",null,3.9,5.9,[31],{"Source":17,"Type":18,"CVSSData":32,"BaseSeverity":25,"ExploitabilityScore":37,"ImpactScore":38,"ACInsufInfo":27,"ObtainAllPrivilege":27,"ObtainUserPrivilege":27,"ObtainOtherPrivilege":27,"UserInteractionRequired":27},{"Version":33,"VectorString":34,"AccessVector":21,"AccessComplexity":22,"Authentication":23,"ConfidentialityImpact":35,"IntegrityImpact":35,"AvailabilityImpact":35,"BaseScore":36,"BaseSeverity":27,"Exploitability":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"CollateralDamagePotential":27,"TargetDistribution":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":27,"EnvironmentalScore":27},"2.0","AV:N\u002FAC:L\u002FAu:N\u002FC:P\u002FI:P\u002FA:P","PARTIAL",7.5,10,6.4,0.05734,[39,39,39,39,39,39,39],"Critical",[43,48,52,55,58,61,64,67,69,71,73,75,78,81,85,88],{"vendor":44,"product":45,"version":46,"criteria":47,"vulnerable":4},"smartbear","swagger_ui","*","cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*",{"vendor":49,"product":50,"version":46,"criteria":51,"vulnerable":4},"oracle","banking_apis","cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:*",{"vendor":49,"product":50,"version":53,"criteria":54,"vulnerable":4},"19.1","cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:*",{"vendor":49,"product":50,"version":56,"criteria":57,"vulnerable":4},"19.2","cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:*",{"vendor":49,"product":50,"version":59,"criteria":60,"vulnerable":4},"20.1","cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*",{"vendor":49,"product":50,"version":62,"criteria":63,"vulnerable":4},"21.1","cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*",{"vendor":49,"product":65,"version":46,"criteria":66,"vulnerable":4},"banking_digital_experience","cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*",{"vendor":49,"product":65,"version":53,"criteria":68,"vulnerable":4},"cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*",{"vendor":49,"product":65,"version":56,"criteria":70,"vulnerable":4},"cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*",{"vendor":49,"product":65,"version":59,"criteria":72,"vulnerable":4},"cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*",{"vendor":49,"product":65,"version":62,"criteria":74,"vulnerable":4},"cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:*",{"vendor":49,"product":76,"version":46,"criteria":77,"vulnerable":4},"banking_platform","cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*",{"vendor":49,"product":79,"version":46,"criteria":80,"vulnerable":4},"primavera_gateway","cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",{"vendor":49,"product":82,"version":83,"criteria":84,"vulnerable":4},"utilities_framework","4.3.0.6.0","cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:*",{"vendor":49,"product":82,"version":86,"criteria":87,"vulnerable":4},"4.4.0.0.0","cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*",{"vendor":49,"product":82,"version":89,"criteria":90,"vulnerable":4},"4.4.0.2.0","cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*",16,[93,98,103,107,110,113,116,119,124,127,130],{"url":94,"source":95,"tags":96},"https:\u002F\u002Fgithub.com\u002Fswagger-api\u002Fswagger-ui\u002Freleases\u002Ftag\u002Fv3.23.11","GitHub",[97],"Release Notes",{"url":99,"source":95,"tags":100},"https:\u002F\u002Fgithub.com\u002Ftarantula-team\u002FCSS-injection-in-Swagger-UI",[101,102],"Exploit","Third Party Advisory",{"url":104,"source":105,"tags":106},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr103579b01da2d0aa0f672b88f811224bbf8ef493aaad845895955e91%40%3Ccommits.airflow.apache.org%3E","Apache",[],{"url":108,"source":105,"tags":109},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr3acb7e494cf1aab99b6784b7c5bbddfd0d4f8a484ab534c3a61ef9cf%40%3Ccommits.airflow.apache.org%3E",[],{"url":111,"source":105,"tags":112},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr84b327f7a8b6b28857b906c07a66dd98e1d341191fa8d7816514ef96%40%3Ccommits.airflow.apache.org%3E",[],{"url":114,"source":105,"tags":115},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr853ffeb915a400f899de78124d4e0d77a19379d2e11bf8f4e98c624f%40%3Ccommits.airflow.apache.org%3E",[],{"url":117,"source":105,"tags":118},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fref70b940c4f69560d29d6ba792d6c82865e74de3dcad4c92d99b1f8f%40%3Ccommits.airflow.apache.org%3E",[],{"url":120,"source":121,"tags":122},"https:\u002F\u002Fwww.oracle.com\u002Fsecurity-alerts\u002FcpuApr2021.html","Oracle",[123,102],"Patch",{"url":125,"source":121,"tags":126},"https:\u002F\u002Fwww.oracle.com\u002Fsecurity-alerts\u002Fcpujan2022.html",[123,102],{"url":128,"source":121,"tags":129},"https:\u002F\u002Fwww.oracle.com\u002Fsecurity-alerts\u002Fcpujul2022.html",[],{"url":131,"source":121,"tags":132},"https:\u002F\u002Fwww.oracle.com\u002Fsecurity-alerts\u002Fcpuoct2020.html",[123,102],11,[135],{"id":136,"name":137,"description":138,"extendedDescription":139,"status":140,"abstraction":141,"structure":142},"CWE-352","Cross-Site Request Forgery (CSRF)","The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.","When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.","Stable","Compound","Composite",1,false,[],{"title":147,"metaDescription":148,"keywords":149,"canonicalUrl":150,"structuredData":151},"What is CVE-2019-17495? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2019-17495, a critical severity cyber security vulnerability from 2019. A Cascading Style Sheets (CSS) injection vulnerability ...","CVE-2019-17495, CVE-2019-17495 vulnerability, CVE-2019-17495 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2019, CVSS score, exploit, patch, remediation, smartbear security, oracle security, swagger_ui vulnerability, banking_apis vulnerability, banking_digital_experience vulnerability","\u002Fwhat-is\u002Fcve-2019-17495",{"@context":152,"@type":153,"headline":147,"description":148,"datePublished":10,"dateModified":11,"author":154,"publisher":158,"about":162,"mainEntityOfPage":166,"articleSection":169,"keywords":170},"https:\u002F\u002Fschema.org","TechArticle",{"@type":155,"name":156,"url":157},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":155,"name":156,"url":157,"logo":159},{"@type":160,"url":161},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":163,"name":6,"description":164,"additionalType":165},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":167,"@id":168},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2019-17495","Cybersecurity","CVE-2019-17495, CVE-2019-17495 vulnerability, CVE-2019-17495 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[172,180],{"Operator":27,"Negate":27,"Nodes":173},[174],{"Operator":175,"Negate":27,"CPEMatch":176},"OR",[177],{"Vulnerable":4,"Criteria":47,"MatchCriteriaID":178,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":179,"VersionEndIncluding":27},"57CBDCB1-31D5-4063-B9BF-51B6AEADF76A","3.23.11",{"Operator":27,"Negate":27,"Nodes":181},[182],{"Operator":175,"Negate":27,"CPEMatch":183},[184,188,190,192,194,196,198,200,202,204,206,210,214,218,220,222],{"Vulnerable":4,"Criteria":51,"MatchCriteriaID":185,"VersionStartExcluding":27,"VersionStartIncluding":186,"VersionEndExcluding":27,"VersionEndIncluding":187},"6DF2D056-3118-4C31-BEDD-69F016898CBB","18.1","18.3",{"Vulnerable":4,"Criteria":54,"MatchCriteriaID":189,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"CF34B11F-3DE1-4C22-8EB1-AEE5CE5E4172",{"Vulnerable":4,"Criteria":57,"MatchCriteriaID":191,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"86F03B63-F922-45CD-A7D1-326DB0042875",{"Vulnerable":4,"Criteria":60,"MatchCriteriaID":193,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"7CBFC93F-8B39-45A2-981C-59B187169BD4",{"Vulnerable":4,"Criteria":63,"MatchCriteriaID":195,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"0843465C-F940-4FFC-998D-9A2668B75EA0",{"Vulnerable":4,"Criteria":66,"MatchCriteriaID":197,"VersionStartExcluding":27,"VersionStartIncluding":186,"VersionEndExcluding":27,"VersionEndIncluding":187},"366A6277-5D74-44C8-94A9-8ADB5568B5FB",{"Vulnerable":4,"Criteria":68,"MatchCriteriaID":199,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"F7BDFC10-45A0-46D8-AB92-4A5E2C1C76ED",{"Vulnerable":4,"Criteria":70,"MatchCriteriaID":201,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"18127694-109C-4E7E-AE79-0BA351849291",{"Vulnerable":4,"Criteria":72,"MatchCriteriaID":203,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"33F68878-BC19-4DB8-8A72-BD9FE3D0ACEC",{"Vulnerable":4,"Criteria":74,"MatchCriteriaID":205,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"0D6895A6-511A-4DC6-9F9B-58E05B86BDB1",{"Vulnerable":4,"Criteria":77,"MatchCriteriaID":207,"VersionStartExcluding":27,"VersionStartIncluding":208,"VersionEndExcluding":27,"VersionEndIncluding":209},"3625D477-1338-46CB-90B1-7291D617DC39","2.4.0","2.10.0",{"Vulnerable":4,"Criteria":80,"MatchCriteriaID":211,"VersionStartExcluding":27,"VersionStartIncluding":212,"VersionEndExcluding":27,"VersionEndIncluding":213},"06CF27F6-ADC1-480C-9D2E-2BD1E7330C32","16.2.0","16.2.11",{"Vulnerable":4,"Criteria":80,"MatchCriteriaID":215,"VersionStartExcluding":27,"VersionStartIncluding":216,"VersionEndExcluding":27,"VersionEndIncluding":217},"C46E7006-37B5-4A23-8116-C54D683D32D1","17.12.0","17.12.8",{"Vulnerable":4,"Criteria":84,"MatchCriteriaID":219,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"8DF02546-3F0D-4FDD-89B1-8A3FE43FB5BF",{"Vulnerable":4,"Criteria":87,"MatchCriteriaID":221,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"3F906F04-39E4-4BE4-8A73-9D058AAADB43",{"Vulnerable":4,"Criteria":90,"MatchCriteriaID":223,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"7B393A82-476A-4270-A903-38ED4169E431",[],[226,233],{"id":227,"eventType":228,"eventTime":229,"details":230,"label":231,"color":232},"92dae37b-37ec-4f1b-9df4-43062e0715a0","LOW_EPSS_DELTA","2025-11-19T04:06:35.22664+00:00","Daily EPSS score decreased by 0.104 on 2023-12-30","EPSS Score Decreased","green",{"id":234,"eventType":235,"eventTime":236,"details":237,"label":238,"color":239},"11784fca-3a0d-425d-85e4-35be490698c6","HIGH_EPSS_DELTA","2025-11-22T04:06:23.242951+00:00","Daily EPSS score increased by 0.104 on 2023-12-30","EPSS Score Increased","red",{"lastModified":11,"cacheTime":241,"version":33},1792270238262,{"score":243,"band":244,"action":245,"scoredAt":246},54,"Medium","Plan remediation","2026-10-16T06:47:02.755881+00:00"]