Swagger UI Vulnerability CVE-2018-25031Issue date: 21-09-2022
Affects versions: 15.1, 14.7, 13.4
Security Issue ID
Affected Product Version(s)
15.1.0, 14.7.8, 13.4.18, and all previous versions
Swagger UI could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a specially-crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.
Swagger UI versions before 4.1.3 are vulnerable to User Interface (UI) Misrepresentation of Critical Information via the ?url parameter, which was intended to allow displaying remote OpenAPI definitions.
Customers are recommended to upgrade to the latest version. As of the time of writing, 15.1.1, 14.7.9 or 13.4.19