search

turkdevops / gitea

Git with a cup of tea, painless self-hosted git service
https://gitea.io
MIT License
0 stars 0 forks source link

CVE-2018-25031 (Medium) detected in swagger-ui-bundle-4.0.0-beta.4.js, swagger-ui-dist-4.0.0-beta.4.tgz #98

Open mend-bolt-for-github[bot] opened 2 years ago

mend-bolt-for-github[bot] commented 2 years ago

CVE-2018-25031 - Medium Severity Vulnerability

Vulnerable Libraries - swagger-ui-bundle-4.0.0-beta.4.js, swagger-ui-dist-4.0.0-beta.4.tgz

swagger-ui-bundle-4.0.0-beta.4.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/4.0.0-beta.4/swagger-ui-bundle.js

Path to dependency file: /node_modules/swagger-ui-dist/index.html

Path to vulnerable library: /node_modules/swagger-ui-dist/./swagger-ui-bundle.js

Dependency Hierarchy: - :x: **swagger-ui-bundle-4.0.0-beta.4.js** (Vulnerable Library)

swagger-ui-dist-4.0.0-beta.4.tgz

[![NPM version](https://badge.fury.io/js/swagger-ui-dist.svg)](http://badge.fury.io/js/swagger-ui-dist)

Library home page: https://registry.npmjs.org/swagger-ui-dist/-/swagger-ui-dist-4.0.0-beta.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/swagger-ui-dist/package.json

Dependency Hierarchy: - :x: **swagger-ui-dist-4.0.0-beta.4.tgz** (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.

Publish Date: 2022-03-11

URL: CVE-2018-25031

CVSS 3 Score Details (4.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-qrmm-w75w-3wpx

Release Date: 2022-03-11

Fix Resolution: swagger-ui - 4.1.3;swagger-ui-dist - 4.1.3

Step up your Open Source Security Game with Mend here