{"id":"CVE-2018-25031","aliases":["CLSA-2026-1785468079","EUVD-2022-1408","GHSA-cr3q-pqgq-m8c2","GHSA-qrmm-w75w-3wpx"],"status":"published","title":"Spoofing attack in swagger-ui","description":"Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.42326,"percentile":0.98711,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20","CWE-918","CWE-922"],"published":"2022-03-11T06:47:46Z","modified":"2026-10-24T10:49:40Z","exploits":[{"source":"pocgithub","id":"afine-com/CVE-2018-25031","title":"afine-com/CVE-2018-25031","date":"2022-05-26","url":"https://github.com/afine-com/CVE-2018-25031"},{"source":"pocgithub","id":"rafaelcintralopes/SwaggerUI-CVE-2018-25031","title":"rafaelcintralopes/SwaggerUI-CVE-2018-25031","date":"2023-04-14","url":"https://github.com/rafaelcintralopes/SwaggerUI-CVE-2018-25031"},{"source":"pocgithub","id":"mathis2001/CVE-2018-25031","title":"mathis2001/CVE-2018-25031","date":"2023-06-28","url":"https://github.com/mathis2001/CVE-2018-25031"},{"source":"pocgithub","id":"LUCASRENAA/CVE-2018-25031","title":"LUCASRENAA/CVE-2018-25031","date":"2023-11-16","url":"https://github.com/LUCASRENAA/CVE-2018-25031"},{"source":"pocgithub","id":"hev0x/CVE-2018-25031-PoC","title":"hev0x/CVE-2018-25031-PoC","date":"2023-12-13","url":"https://github.com/hev0x/CVE-2018-25031-PoC"},{"source":"pocgithub","id":"johnlaurance/CVE-2018-25031-test2","title":"johnlaurance/CVE-2018-25031-test2","date":"2024-02-22","url":"https://github.com/johnlaurance/CVE-2018-25031-test2"},{"source":"pocgithub","id":"geozin/POC-CVE-2018-25031","title":"geozin/POC-CVE-2018-25031","date":"2024-05-15","url":"https://github.com/geozin/POC-CVE-2018-25031"},{"source":"pocgithub","id":"h2oa/CVE-2018-25031","title":"h2oa/CVE-2018-25031","date":"2024-05-21","url":"https://github.com/h2oa/CVE-2018-25031"},{"source":"pocgithub","id":"natpakun/SSRF-CVE-2018-25031-","title":"natpakun/SSRF-CVE-2018-25031-","date":"2024-07-24","url":"https://github.com/natpakun/SSRF-CVE-2018-25031-"},{"source":"pocgithub","id":"KonEch0/CVE-2018-25031-SG","title":"KonEch0/CVE-2018-25031-SG","date":"2024-11-15","url":"https://github.com/KonEch0/CVE-2018-25031-SG"},{"source":"pocgithub","id":"nigartest/CVE-2018-25031","title":"nigartest/CVE-2018-25031","date":"2025-04-18","url":"https://github.com/nigartest/CVE-2018-25031"},{"source":"pocgithub","id":"h4ckt0m/CVE-2018-25031-test","title":"h4ckt0m/CVE-2018-25031-test","date":"2025-06-18","url":"https://github.com/h4ckt0m/CVE-2018-25031-test"},{"source":"pocgithub","id":"rasinfosec/CVE-2018-25031","title":"rasinfosec/CVE-2018-25031","date":"2025-06-18","url":"https://github.com/rasinfosec/CVE-2018-25031"},{"source":"pocgithub","id":"RelicHunt3r/swagger-ui","title":"RelicHunt3r/swagger-ui","date":"2025-09-20","url":"https://github.com/RelicHunt3r/swagger-ui"},{"source":"pocgithub","id":"labeebSabbah/CVE-2018-25031","title":"labeebSabbah/CVE-2018-25031","date":"2025-11-10","url":"https://github.com/labeebSabbah/CVE-2018-25031"}],"fixes":[{"ecosystem":"npm","package":"swagger-ui","fixed_in":["4.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.webjars:swagger-ui","fixed_in":["4.1.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"swagger-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.webjars:swagger-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"swagger-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.10-tuxcare.0"},{"fixed":"2.2.10-tuxcare.1"}]}],"versions":["2.2.10"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"swagger-ui","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.1.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.webjars:swagger-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3"}]}],"versions":["2.0.12","2.0.14","2.0.14-1","2.0.17","2.0.18","2.0.21","2.0.22","2.0.24","2.1.0","2.1.0-M1","2.1.0-alpha.6","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.8-M1","2.2.0","2.2.10","2.2.10-1","2.2.2","2.2.5","2.2.6","2.2.8","3.0.10","3.0.14","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.21","3.0.3","3.0.4","3.0.5","3.0.7","3.0.8","3.1.2","3.1.4","3.1.5","3.1.6","3.1.7","3.10.0","3.11.0","3.12.0","3.12.1","3.13.0","3.13.1","3.13.2","3.13.3","3.13.4","3.13.6","3.14.0","3.14.2","3.17.0","3.17.1","3.17.2","3.17.3","3.17.4","3.17.6","3.18.1","3.18.2","3.19.0","3.19.4","3.19.5","3.2.0","3.2.2","3.20.0","3.20.1","3.20.2","3.20.3","3.20.5","3.20.8","3.20.9","3.22.0","3.22.1","3.22.2","3.23.0","3.23.11","3.23.2","3.23.4","3.23.5","3.23.8","3.24.0","3.24.2","3.24.3","3.25.0","3.25.1","3.25.2","3.25.3","3.25.4","3.25.5","3.26.0","3.26.1","3.27.0","3.28.0","3.30.0","3.31.1","3.32.1","3.32.3","3.32.5","3.34.0","3.35.0","3.35.1","3.35.2","3.36.0","3.36.1","3.36.2","3.37.0","3.37.2","3.38.0","3.4.4","3.40.0","3.41.1","3.42.0","3.43.0","3.44.0","3.45.0","3.46.0","3.47.1","3.48.0","3.49.0","3.5.0","3.50.0","3.51.0","3.51.1","3.51.2","3.52.1","3.52.3","3.52.5","3.6.1","3.7.0","3.8.0","3.9.0","3.9.1","3.9.2","3.9.3","4.0.0","4.0.1","4.1.0","4.1.2"]}],"products":[{"vendor":"smartbear","product":"swagger_ui"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-SWAGGERUI-2314885","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/swagger-api/swagger-ui/issues/4872","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/swagger-api/swagger-ui/releases/tag/v4.1.3","tags":["x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20220407-0004/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-25031","tags":["advisory"]},{"url":"https://github.com/swagger-api/swagger-ui/pull/7697","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20220407-0004","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cr3q-pqgq-m8c2"},{"url":"https://github.com/swagger-api/swagger-ui","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-25031","description":"Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.","status":"published","published":"2022-03-11T06:47:46Z","modified":"2024-08-05T12:26:39.523Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-922","CWE-918","CWE-20"],"updated_at":"2026-11-02T14:35:01.952568Z"}],"euvd":[{"id":"EUVD-2022-1408","description":"Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.","status":"published","published":"2022-03-11T06:47:46Z","modified":"2024-08-05T12:26:39Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T02:39:27.400094Z"}],"ghsa":[{"id":"GHSA-cr3q-pqgq-m8c2","title":"Spoofing attack in swagger-ui","description":"Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.","status":"published","published":"2022-03-12T00:00:36Z","modified":"2025-09-02T22:24:00Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-20","CWE-918","CWE-922"],"updated_at":"2026-11-02T14:38:55.953734Z"}],"nvd":[{"id":"CVE-2018-25031","description":"Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.","status":"published","published":"2022-03-11T07:15:07.19Z","modified":"2026-06-17T01:54:33.51Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-918","CWE-922"],"updated_at":"2026-11-02T14:05:00.565712Z"}],"osv":[{"id":"CVE-2018-25031","description":"Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.","status":"published","published":"2022-03-11T07:15:07.19Z","modified":"2026-10-24T10:49:40.852168289Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"GHSA-cr3q-pqgq-m8c2","title":"Spoofing attack in swagger-ui","description":"Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.","status":"published","published":"2022-03-12T00:00:36Z","modified":"2025-09-02T22:38:08.350811Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-20","CWE-918","CWE-922"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"CLSA-2026-1785468079","title":"TuxCare security update for swagger-ui (3 CVEs)","description":"TuxCare rebuilt swagger-ui to address 3 CVEs. Fixed in 2.2.10-tuxcare.1.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:45:58.21695549Z","updated_at":"2026-11-02T15:43:46.850893Z"}]}}