Homepage
About Snyk

Arbitrary Code Execution Affecting io.swagger:swagger-codegen package, versions [,2.2.0)

0.0
critical

Snyk CVSS

    Attack Complexity Low
    Confidentiality High
    Integrity High
    Availability High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-IOSWAGGER-30444
  • published 21 Jul 2016
  • disclosed 21 Jul 2016
  • credit Scott Davis
Report a new vulnerability Found a mistake?

Introduced: 21 Jul 2016

CVE-2016-5641 Open this link in a new tab
CWE-94 Open this link in a new tab

Overview

io.swagger:swagger-codegen is a simple yet powerful representation of your RESTful API.

Affected versions of this package are vulnerable to Arbitrary Code Execution via parameter injection. By leveraging this vulnerability, an attacker can inject arbitrary execution code embedded with a client or server generated automatically to interact with the definition of service.