Cxcc0ac612-9ed7 @ Npm-swagger-ui-dist-3.52.5

[Abdul1110]

Vulnerable Package issue exists @ Npm-swagger-ui-dist-3.52.5 in branch master

SwaggerUI supports displaying remote OpenAPI definitions through the "?url" parameter. This enables robust demonstration capabilities on sites like "petstore.swagger.io", "editor.swagger.io", and similar sites, where users often want to see what their OpenAPI definitions would look like rendered. However, this functionality may pose a risk for users who host their own SwaggerUI instances. In particular, including remote OpenAPI definitions opens a vector for phishing attacks by abusing the trusted names/domains of self-hosted instances resulting in SSRF. This issue is fixed in version 4.1.3.

Namespace: Abdul1110
Repository: TEST_ORION
Repository Url: https://github.com/Abdul1110/TEST_ORION
CxAST-Project: Abdul1110/TEST_ORION
CxAST platform scan: 19490220-b272-4b92-94fa-50af22248f60
Branch: master
Application: TEST_ORION
Severity: HIGH
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-918

---

Addition Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: NONE
Remediation Upgrade Recommendation: 4.1.3

---

References
Advisory
Issue
Pull request
Commit