Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-25031: Swagger UI 4.1.2 and earlier allows attackers to display fake APIs

CVE-2018-25031 · published 4 years ago

Summary

An attacker can trick users into visiting a malicious link, which could display fake API information. This could be used to deceive users into trusting a fake online service. To protect against this, update Swagger UI to the latest version or configure your system to prevent users from navigating to arbitrary URLs.

What to do

Update swagger-api swagger-ui to version 4.1.3.
Update webjars org.webjars:swagger-ui to version 4.1.3.
Update smartbear swagger_ui to version 4.1.3 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	swagger-api	swagger-ui	< 4.1.3 Fix: upgrade to 4.1.3
maven	webjars	org.webjars:swagger-ui	< 4.1.3 Fix: upgrade to 4.1.3
–	smartbear	swagger_ui	< 4.1.3 `cpe:2.3:a:smartbear:swagger_ui::::::::`

Original advisory text

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.3 Medium

Exploitation

42% chance of attack within 30 days

Type

CWE-20Improper Input Validation

CWE-918Server-Side Request Forgery (SSRF)

CWE-922Insecure Storage of Sensitive Information

Timeline

Published11 Mar 2022

Updated30 Sep 2026

First seen6 Mar 2026

Sources

GHSA-cr3q-pqgq-m8c2 · GHSA

CVE-2018-25031 · NVD

Track software like this

Free during beta