Swagger UI Vulnerability CVE-2018-25031 

Issue date: 21-09-2022
Affects versions: 15.1, 14.7, 13.4

Security Issue ID

SECURITY-338

 

Affected Product Version(s)

15.1.0, 14.7.8, 13.4.18, and all previous versions

Severity 

Medium

Description

CVE-2018-25031

Swagger UI could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a specially-crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.

Swagger UI versions before 4.1.3 are vulnerable to User Interface (UI) Misrepresentation of Critical Information via the ?url parameter, which was intended to allow displaying remote OpenAPI definitions.

Instructions

Customers are recommended to upgrade to the latest version. As of the time of writing, 15.1.1, 14.7.9 or 13.4.19