io.swagger:swagger-codegen@2.1.2 vulnerabilities
-
latest version
2.4.43
-
latest non vulnerable version
-
first published
9 years ago
-
latest version published
2 months ago
-
licenses detected
- [2.1.1,)
-
package manager
Direct Vulnerabilities
Known vulnerabilities in the io.swagger:swagger-codegen package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.Vulnerability | Vulnerable Version |
---|---|
Affected versions of this package are vulnerable to Information Exposure. On unix-like systems, the temporary directory is shared between all users. As such, writing to this directory using API's that do not explicitly set the file/directory permissions can lead to information disclosure.
When files/directories are created using the How to fix Information Exposure? Upgrade |
[,2.4.19)
|
Affected versions of this package are vulnerable to Arbitrary Code Execution via the yaml parsing functionality. When a maliciously crafted yaml Open-API specification is parsed, it is possible to execute arbitrary code on the hosting server. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification. How to fix Arbitrary Code Execution? Upgrade |
[,2.2.3)
|
Affected versions of this package are vulnerable to Arbitrary Code Execution via parameter injection. By leveraging this vulnerability, an attacker can inject arbitrary execution code embedded with a client or server generated automatically to interact with the definition of service. |
[,2.2.0)
|