GitHub Advisoryadvisory · Maven

GHSA-wg4w-5m5r-w3p8 OpenAPI Generator vulnerable to Server-Side Request Forgery

CRITICAL Published 2023-03-31 Modified 2023-04-07 Official page ↗
Aliases
CVE-2023-27162
Ecosystem
Maven
Packages
org.openapitools:openapi-generator-project
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-918
Reviewed
2023-03-31

Affected packages

• Maven org.openapitools:openapi-generator-project: <= 6.4.0 (no fix yet)

Description

openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component `/api/gen/clients/{language}`. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.

Related

Alias · CVE (1)

  • CVE-2023-27162 openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References