CVE-2018-25031: smartbear swagger_ui Improper Input Validation

Vulnerability summary

CVE-2018-25031 is a medium (CVSS 4.3) Improper Input Validation vulnerability in smartbear swagger_ui. EPSS estimates a 42.33% chance of exploitation in the next 30 days, higher than 98.6% of scored vulnerabilities.

Timeline

1. 11-03-2022
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
• CWE-922Insecure Storage of Sensitive InformationThe product stores sensitive information without properly limiting read or write access by unauthorized actors.