Vulnerabilities

TI-2023-27375 CVE-2023-50069 · GHSA-qhjx-8fqw-x3cm

WireMock with GUI versions 3.2.0.0 through 3.0.4.0 are vulnerable to stored cross-site…

LOW 28

WireMock with GUI versions 3.2.0.0 through 3.0.4.0 are vulnerable to stored cross-site scripting (SXSS) through the recording feature.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00442 Published 2023-12-29 No fix listed CWE-79

TI-2023-21927 CVE-2023-41327 · GHSA-hq8w-9w8w-pmx7

Controlled SSRF through URL in the WireMock

LOW 25

WireMock is a tool for mocking HTTP services.

CVSS 3.1MEDIUM 5.4 Adjacent network No auth No interaction EPSS 0.00498 Published 2023-09-06 Fixed in 3.0.3, 2.35.1 CWE-918

TI-2023-21929 CVE-2023-41329 · GHSA-pmxq-pj47-j8j4

Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio

LOW 30

WireMock is a tool for mocking HTTP services.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.00629 Published 2023-09-06 Fixed in 3.0.3, 2.35.1 +1 CWE-290

TI-2018-06621 CVE-2018-9117 · GHSA-wf78-3ph3-fqwr

WireMock before 2.16.0 contains a vulnerability that allows a remote unauthenticated…

LOW 29

WireMock before 2.16.0 contains a vulnerability that allows a remote unauthenticated attacker to access local files beyond the application directory via a specially crafted XML request, aka Directory Traversal.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.02608 Published 2018-03-29 No fix listed CWE-22

TI-2018-06620 CVE-2018-9116 · GHSA-xf3g-mqgg-66g3

An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated…

MEDIUM 43

An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to access local files and internal resources and potentially cause a Denial of Service.

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.01947 Published 2018-03-29 No fix listed CWE-611