Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API
Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.
CVE-2018-25031 - Medium Severity Vulnerability
swagger-ui-bundle-4.0.0-beta.4.js
Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API
Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/4.0.0-beta.4/swagger-ui-bundle.js
Path to dependency file: /node_modules/swagger-ui-dist/index.html
Path to vulnerable library: /node_modules/swagger-ui-dist/./swagger-ui-bundle.js
Dependency Hierarchy: - :x: **swagger-ui-bundle-4.0.0-beta.4.js** (Vulnerable Library)
swagger-ui-dist-4.0.0-beta.4.tgz
[![NPM version](https://badge.fury.io/js/swagger-ui-dist.svg)](http://badge.fury.io/js/swagger-ui-dist)
Library home page: https://registry.npmjs.org/swagger-ui-dist/-/swagger-ui-dist-4.0.0-beta.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/swagger-ui-dist/package.json
Dependency Hierarchy: - :x: **swagger-ui-dist-4.0.0-beta.4.tgz** (Vulnerable Library)
Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0
Found in base branch: main
Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.
Publish Date: 2022-03-11
URL: CVE-2018-25031
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/advisories/GHSA-qrmm-w75w-3wpx
Release Date: 2022-03-11
Fix Resolution: swagger-ui - 4.1.3;swagger-ui-dist - 4.1.3
Step up your Open Source Security Game with Mend here