CVE-2018-25031

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-25031
Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://github.com/swagger-api/swagger-ui/issues/4872 Issue Tracking Patch Third Party Advisory
https://github.com/swagger-api/swagger-ui/releases/tag/v4.1.3 Release Notes Third Party Advisory
https://security.netapp.com/advisory/ntap-20220407-0004/ Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-SWAGGERUI-2314885 Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
History

01 Aug 2024, 13:41

Type Values Removed Values Added
CWE CWE-922
CWE-918

17 Jul 2024, 22:15

Type Values Removed Values Added
Summary (en) Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. (en) Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.

03 Jun 2022, 16:22

Type Values Removed Values Added
References (CONFIRM) https://security.netapp.com/advisory/ntap-20220407-0004/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20220407-0004/ - Third Party Advisory

08 Apr 2022, 00:15

Type Values Removed Values Added
References
  • (CONFIRM) https://security.netapp.com/advisory/ntap-20220407-0004/ -

22 Mar 2022, 13:33

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : 4.3
v3 : 4.3
CPE cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
CWE CWE-20
References (MISC) https://security.snyk.io/vuln/SNYK-JS-SWAGGERUI-2314885 - (MISC) https://security.snyk.io/vuln/SNYK-JS-SWAGGERUI-2314885 - Patch, Third Party Advisory
References (MISC) https://github.com/swagger-api/swagger-ui/releases/tag/v4.1.3 - (MISC) https://github.com/swagger-api/swagger-ui/releases/tag/v4.1.3 - Release Notes, Third Party Advisory
References (MISC) https://github.com/swagger-api/swagger-ui/issues/4872 - (MISC) https://github.com/swagger-api/swagger-ui/issues/4872 - Issue Tracking, Patch, Third Party Advisory

11 Mar 2022, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-03-11 07:15

Updated : 2024-08-01 13:41

NVD link : CVE-2018-25031

Mitre link : CVE-2018-25031

CVE.ORG link : CVE-2018-25031

JSON object : View

Products Affected

smartbear

  • swagger_ui
CWE
CWE-20

Improper Input Validation

CWE-918

Server-Side Request Forgery (SSRF)

CWE-922

Insecure Storage of Sensitive Information