Invoiceninja: Swagger-ui XSS

[Baledin]

I've just received a note from my webhost regarding a CVE for Swagger-UI <2.2.1. It turns out that Swagger-UI v2.1.1 is included in Invoice Ninja and is subject to limited XSS.

My webhost is auto-flagging and blocking the file "for me" but haven't dug in enough to see what impacts it would have to keep it blocked/update it.

CVE details: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5682

** Note, first issue report ever so hope I'm not breaking any unknown (to me) rules/formatting/etc :)

[turbo124]

@Baledin it won't impact on the functionality of your intstallation if they have blocked this 'file'

I don't think this CVE affects us at all, but they've marked it as a positive because it has the 'potential' to be a security flaw.

[Baledin]

@turbo124 Thanks for the response. Based on my reading it looked like they had to have already compromised the system to exploit this CVE so I was more concerned that it would impact system usage if the file was blocked.

Cheers!

[turbo124]

No probs, i'm going close this issue. Let us know if there is anything else.