Spoofing attack in swagger-ui

MEDIUM 4.3CVE-2018-25031 · GHSA-cr3q-pqgq-m8c2 · Published 11/03/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
org.webjars:swagger-ui Maven	`< 4.1.3`	`4.1.3`
swagger ui smartbear	`< 4.1.3`	`4.1.3`
swagger-ui npm	`< 4.1.3`	`4.1.3`

Description

Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.

NVD description

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.

References

nvd.nist.gov/vuln/detail/CVE-2018-25031 · ADVISORY
swagger-api/swagger-ui · WEB
swagger-api/swagger-ui#7697 · WEB
swagger-api/swagger-ui · PACKAGE
swagger-api/swagger-ui release v4.1.3 · WEB
security.netapp.com/advisory/ntap-20220407-0004 · WEB
security.snyk.io/vuln/SNYK-JS-SWAGGERUI-2314885 · WEB
security.netapp.com/advisory/ntap-20220407-0004 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free