GitHub Advisoryadvisory · npm, Maven

GHSA-cr3q-pqgq-m8c2 Spoofing attack in swagger-ui

MEDIUM Published 2022-03-12 Modified 2025-09-02 Official page ↗
Aliases
CVE-2018-25031
Ecosystem
npm, Maven
Packages
swagger-ui, org.webjars:swagger-ui
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-20, CWE-918, CWE-922
Reviewed
2022-03-14

Affected packages

• npm swagger-ui: < 4.1.3 → fixed in 4.1.3 • Maven org.webjars:swagger-ui: < 4.1.3 → fixed in 4.1.3

Description

Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.

Related

Alias · CVE (1)

  • CVE-2018-25031 Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. vulnerability

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-918 Server-Side Request Forgery weakness
  • CWE-922 Insecure Storage of Sensitive Information weakness

References