CVE-2018-25031

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-20CWE-918CWE-922

Affected software

No affected versions have been published.

Timeline

Published
Mar 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-250327.5zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.CVE-2018-250338.1ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in CVE-2018-250345.4A vulnerability, which was classified as problematic, has been found in Thomson TCW710 ST5D.10.05. This issue affects some unknown processinCVE-2018-250355.4A vulnerability, which was classified as problematic, was found in Thomson TCW710 ST5D.10.05. Affected is an unknown function of the file /gCVE-2018-250365.4A vulnerability has been found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this vulnerability is an unknown funcCVE-2018-250375.4A vulnerability was found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this issue is some unknown functionality oCVE-2018-250385.4A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been classified as problematic. This affects an unknown part of the file /gofCVE-2018-250395.4A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been declared as problematic. This vulnerability affects unknown code of the CVE-2018-25046.1SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header MaCVE-2018-250408.8A vulnerability was found in uTorrent Web. It has been declared as critical. Affected by this vulnerability is an unknown functionality of tCVE-2018-250418.8A vulnerability was found in uTorrent. It has been rated as critical. Affected by this issue is some unknown functionality of the component CVE-2018-250428.8A vulnerability classified as critical has been found in uTorrent. This affects an unknown part. The manipulation leads to memory corruption