Spoofing attack in swagger-ui

中 4.3CVE-2018-25031 · GHSA-cr3q-pqgq-m8c2 · 11/03/2022 公開 · 17/06/2026 更新

要点

CVE-2018-25031 は org.webjars:swagger-ui, swagger ui (smartbear), swagger-ui に影響する深刻度「中」 (CVSS 4.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：42.3%（全脆弱性の 98.7% より高い）。
対処：4.1.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.webjars:swagger-ui Maven	`< 4.1.3`	`4.1.3`
swagger ui smartbear	`< 4.1.3`	`4.1.3`
swagger-ui npm	`< 4.1.3`	`4.1.3`

概要

Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.

NVD の説明

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.