Vulnerabilities

TI-2023-11951 CVE-2023-27162 · GHSA-wg4w-5m5r-w3p8

openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery…

HIGH 80

openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00935 Published 2023-03-31 No fix listed CWE-918

TI-2021-04528 CVE-2021-21430 · GHSA-cqxr-xf2w-943w

Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code

LOW 28

OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.00404 Published 2021-05-10 Fixed in 5.1.0 CWE-269

TI-2021-04526 CVE-2021-21428 · GHSA-23x4-m842-fmwf

Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator

MEDIUM 40

Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec.

CVSS 3.1CRITICAL 9.3 Local No auth No interaction EPSS 0.00351 Published 2021-05-10 Fixed in 5.1.0 CWE-269

TI-2021-04527 CVE-2021-21429 · GHSA-867q-77cc-98mv

Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin

LOW 19

OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI Spec.

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.00296 Published 2021-04-27 Fixed in 5.1.0 CWE-552

TI-2019-08521 CVE-2019-11405 · GHSA-27j5-2h6r-c9q2

OpenAPI Tools OpenAPI Generator before 4.0.0-20190419.052012-560 uses http:// URLs in…

LOW 38

OpenAPI Tools OpenAPI Generator before 4.0.0-20190419.052012-560 uses http:// URLs in various build.gradle, build.gradle.mustache, and build.sbt files, which may have caused insecurely resolved dependencies.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.01198 Published 2019-04-21 Fixed in 4.0.0-20190419.052012-560 CWE-311