CVE-2018-25031

Katalog CVE

CVSS 4.3 · Medium EPSS 42,3%

Kerentanan Improper Input Validation pada smartbear swagger ui. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.

Rincian

Terbit di NVD

11 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-918: Server-Side Request Forgery (SSRF)
CWE-922: Insecure Storage of Sensitive Information

EPSS (30 hari)

42,3% peluang dieksploitasi; lebih tinggi dari 98,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/swagger-api/swagger-ui/issues/4872 issue tracking · patch · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JS-SWAGGERUI-2314885 patch · advisory pihak ketiga
• https://github.com/swagger-api/swagger-ui/releases/tag/v4.1.3 release notes · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220407-0004/ advisory pihak ketiga