Vulnerability	Vulnerable Version
M Server-side Request Forgery (SSRF) swagger-ui-express is a module that allows you to serve auto-generated swagger-ui generated API docs from express, based on a swagger.json file. Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the `?url` parameter, which was intended to allow displaying remote OpenAPI definitions. This functionality may pose a risk for users who host their own SwaggerUI instances. In particular, including remote OpenAPI definitions opens a vector for phishing attacks by abusing the trusted names/domains of self-hosted instances. NOTE: This vulnerability has also been identified as: CVE-2021-46708 How to fix Server-side Request Forgery (SSRF)? Upgrade `swagger-ui-express` to version 4.3.0 or higher.	<4.3.0
M Server-side Request Forgery (SSRF) swagger-ui-express is a module that allows you to serve auto-generated swagger-ui generated API docs from express, based on a swagger.json file. Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the `?url` parameter, which was intended to allow displaying remote OpenAPI definitions. This functionality may pose a risk for users who host their own SwaggerUI instances. In particular, including remote OpenAPI definitions opens a vector for phishing attacks by abusing the trusted names/domains of self-hosted instances. NOTE: This vulnerability has also been identified as: CVE-2018-25031 How to fix Server-side Request Forgery (SSRF)? Upgrade `swagger-ui-express` to version 4.3.0 or higher.	<4.3.0

Server-side Request Forgery (SSRF)

swagger-ui-express is a module that allows you to serve auto-generated swagger-ui generated API docs from express, based on a swagger.json file.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the ?url parameter, which was intended to allow displaying remote OpenAPI definitions. This functionality may pose a risk for users who host their own SwaggerUI instances. In particular, including remote OpenAPI definitions opens a vector for phishing attacks by abusing the trusted names/domains of self-hosted instances.

NOTE: This vulnerability has also been identified as: CVE-2021-46708

How to fix Server-side Request Forgery (SSRF)?

Upgrade swagger-ui-express to version 4.3.0 or higher.

<4.3.0

Server-side Request Forgery (SSRF)

swagger-ui-express is a module that allows you to serve auto-generated swagger-ui generated API docs from express, based on a swagger.json file.

NOTE: This vulnerability has also been identified as: CVE-2018-25031

How to fix Server-side Request Forgery (SSRF)?

Upgrade swagger-ui-express to version 4.3.0 or higher.

<4.3.0

Go back to all versions of this package