Is CVE-2021-46708 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-46708 being exploited in the wild.

How severe is CVE-2021-46708?

Low severity, with a CVSS score of 3.1, published 12 March 2022.

Which products and versions are affected?

swagger-ui-dist (npm) SEMVER:introduced=0,fixed=4.1.3.

Is there a fix for CVE-2021-46708?

Yes. swagger-ui-dist (npm): upgrade to 4.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-46708 attacked?

It is attacked over the network.

Am I affected by CVE-2021-46708?

Check whether you run swagger-ui-dist (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-46708: swagger-ui-dist clickjacking vulnerability

CVE-2021-46708 · Severity: low · CVSS 3.1 · Published 2022-03-12

swagger-ui-dist is a JavaScript library that generates interactive API documentation from OpenAPI specifications. An attacker could trick users into clicking malicious links or buttons by hijacking click actions through a spoofing attack, potentially leading to account compromise or phishing attacks.

Vendors: npm.

Quick answers

Is CVE-2021-46708 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-46708 being exploited in the wild.
How severe is CVE-2021-46708?: Low severity, with a CVSS score of 3.1, published 12 March 2022.
Which products and versions are affected?: swagger-ui-dist (npm) SEMVER:introduced=0,fixed=4.1.3.
Is there a fix for CVE-2021-46708?: Yes. swagger-ui-dist (npm): upgrade to 4.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-46708 attacked?: It is attacked over the network.
Am I affected by CVE-2021-46708?: Check whether you run swagger-ui-dist (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

swagger-ui-dist (npm): upgrade to 4.1.3 or later
```
npm install swagger-ui-dist@4.1.3
```

Technical details

This vulnerability is a clickjacking attack (CWE-1021) that allows remote attackers to hijack user click actions on swagger-ui-dist pages. The vulnerability affects all versions before 4.1.3 and does not require authentication. An attacker must persuade a victim to visit a malicious website hosting or embedding swagger-ui-dist, where the attacker can intercept and redirect click actions to perform unintended operations. The vulnerability was patched in version 4.1.3.

Affected products

Swagger API swagger-ui-dist before 4.1.3

Identifiers

CVE-2021-46708
GHSA-6c9x-mj3g-h47x

Timeline

2022-03-12: disclosed
2022-03-12: patched: Version 4.1.3 released

References

https://github.com/swagger-api/swagger-ui

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.