漏洞描述
Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
blog.vidocsecurity.comhttps://blog.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2018-25031↗github.comhttps://github.com/barrykooij/related-posts-for-wp/commit/37733398dd88863fc0bdb3d6d378598429fd0b81↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2022-3506↗github.comhttps://github.com/swagger-api/swagger-ui/issues/4872↗