CVE-2024-22207
Default swagger-ui configuration exposes all files in the module
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting the `baseDir` option can also work around this vulnerability.
fastify-swagger-ui es un complemento de Fastify para servir la interfaz de usuario de Swagger. Antes de 2.1.0, la configuración predeterminada de `@fastify/swagger-ui` sin `baseDir` configurado hará que todos los archivos en el directorio del módulo queden expuestos a través de rutas http servidas por el módulo. La vulnerabilidad se solucionó en v2.1.0. Configurar la opción `baseDir` también puede solucionar esta vulnerabilidad.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2024-01-08 CVE Reserved
- 2024-01-15 CVE Published
- 2024-08-01 CVE Updated
- 2024-09-25 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-1188: Initialization of a Resource with an Insecure Default
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
https://security.netapp.com/advisory/ntap-20240216-0002 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://github.com/fastify/fastify-swagger-ui/commit/13d799a2c5f14d3dd5b15892e03bbcbae63ee6f7 | 2024-02-16 |
URL | Date | SRC |
---|---|---|
https://github.com/fastify/fastify-swagger-ui/security/advisories/GHSA-62jr-84gf-wmg4 | 2024-02-16 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Smartbear Search vendor "Smartbear" | Swagger Ui Search vendor "Smartbear" for product "Swagger Ui" | >= 2.0.0 < 2.1.0 Search vendor "Smartbear" for product "Swagger Ui" and version " >= 2.0.0 < 2.1.0" | node.js |
Affected
|