Vulnerabilities

TI-2024-14800 CVE-2024-22207 · GHSA-62jr-84gf-wmg4

Default swagger-ui configuration exposes all files in the module

LOW 28

fastify-swagger-ui is a Fastify plugin for serving Swagger UI.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0229 Published 2024-01-15 Fixed in 2.1.0 CWE-1188

TI-2018-15258 CVE-2018-25031 · GHSA-cr3q-pqgq-m8c2

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks.

MEDIUM 53

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.42326 Published 2022-03-11 Fixed in 4.1.3 CWE-20

TI-2019-13041 CVE-2019-17495 · GHSA-c427-hjc3-wrfw

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11…

MEDIUM 51

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltr…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05734 Published 2019-10-10 Fixed in 3.23.11, 2.10.0 CWE-352

Vulnerabilities

Filters

Default swagger-ui configuration exposes all files in the module

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks.

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11…