Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.
References
| Link | Resource |
|---|---|
| https://github.com/swagger-api/swagger-ui/issues/4872 | Issue Tracking Patch Third Party Advisory |
| https://github.com/swagger-api/swagger-ui/releases/tag/v4.1.3 | Release Notes Third Party Advisory |
| https://security.snyk.io/vuln/SNYK-JS-SWAGGERUI-2314885 | Patch Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20220407-0004/ | Third Party Advisory |
Configurations
History
17 Jul 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others. |
Information
Published : 2022-03-11 07:15
Updated : 2024-08-01 13:41
NVD link : CVE-2018-25031
Mitre link : CVE-2018-25031
JSON object : View
Products Affected
smartbear
- swagger_ui
CWE
CWE-20
Improper Input Validation