CVE-2018-25031
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2018-25031
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Swagger UI 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Swagger UI是一款支持可视化API资源并能够与之进行交互的开源工具。 Swagger-api Swagger UI 4.1.3之前版本中存在安全漏洞，该漏洞源于软件缺少对于用户提交的URL数据过滤和转义。攻击者可以通过特制的URL数据利用该漏洞进行欺骗攻击并显示远程OpenAPI定义。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2018-25031
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | .json and .yaml files used to exploit CVE-2018-25031 | https://github.com/afine-com/CVE-2018-25031 | POC Details |
| 2 | None | https://github.com/kriso4os/CVE-2018-25031 | POC Details |
| 3 | Exploit Swagger UI - User Interface (UI) Misrepresentation of Critical Information (CVE-2018-25031) | https://github.com/rafaelcintralopes/SwaggerUI-CVE-2018-25031 | POC Details |
| 4 | CVE-2018-25031 tests | https://github.com/mathis2001/CVE-2018-25031 | POC Details |
| 5 | CVE-2018-25031 Test PoC | https://github.com/wrkk112/CVE-2018-25031 | POC Details |
| 6 | None | https://github.com/LUCASRENAA/CVE-2018-25031 | POC Details |
| 7 | PoC of CVE-2018-25031 | https://github.com/hev0x/CVE-2018-25031-PoC | POC Details |
| 8 | None | https://github.com/ThiiagoEscobar/CVE-2018-25031 | POC Details |
| 9 | None | https://github.com/johnlaurance/CVE-2018-25031-test2 | POC Details |
| 10 | None | https://github.com/nullbyter19/CVE-2018-25031 | POC Details |
| 11 | A simple POC (CVE-2018-25031 | https://github.com/geozin/POC-CVE-2018-25031 | POC Details |
| 12 | None | https://github.com/h2oa/CVE-2018-25031 | POC Details |
| 13 | None | https://github.com/natpakun/SSRF-CVE-2018-25031- | POC Details |
| 14 | CVE-2018-25031-SG | https://github.com/KonEch0/CVE-2018-25031-SG | POC Details |
| 15 | Testing for exploitation | https://github.com/Proklinius897/CVE-2018-25031-tests | POC Details |
| 16 | None | https://github.com/MMAKINGDOM/CVE-2018-25031 | POC Details |
| 17 | Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. | https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2018/CVE-2018-25031.yaml | POC Details |
| 18 | CVE-2018-25031 | https://github.com/nigartest/CVE-2018-25031 | POC Details |
| 19 | None | https://github.com/faccimatteo/CVE-2018-25031 | POC Details |
| 20 | None | https://github.com/h4ckt0m/CVE-2018-25031-test | POC Details |
| 21 | None | https://github.com/rasinfosec/CVE-2018-25031 | POC Details |
| 22 | POC for Testing HTML Injection in Swagger UI (CVE-2018-25031). | https://github.com/rh007pt/swagger-ui | POC Details |
| 23 | POC for Testing HTML Injection in Swagger UI (CVE-2018-25031). | https://github.com/RelicHunt3r/swagger-ui | POC Details |
| 24 | None | https://github.com/labeebSabbah/CVE-2018-25031 | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-25031
请登录查看更多情报信息。
- https://security.snyk.io/vuln/SNYK-JS-SWAGGERUI-2314885x_refsource_MISC
- https://github.com/swagger-api/swagger-ui/issues/4872x_refsource_MISC
- https://github.com/swagger-api/swagger-ui/releases/tag/v4.1.3x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20220407-0004/x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2018-25031
Same Patch Batch · n/a · 2022-03-11 · 41 CVEs total
| CVE-2022-24433 | 8.1 HIGH | Command Injection |
| CVE-2022-25839 | 4.3 MEDIUM | Improper Input Validation |
| CVE-2021-44618 | Nystudio107 Seomatic 代码注入漏洞 | |
| CVE-2022-23927 | HP PC 安全漏洞 | |
| CVE-2022-23934 | HP PC 安全漏洞 | |
| CVE-2022-23931 | HP PC 安全漏洞 | |
| CVE-2022-23930 | HP PC 安全漏洞 | |
| CVE-2022-23924 | HP PC 安全漏洞 | |
| CVE-2022-23925 | HP PC 安全漏洞 | |
| CVE-2022-23731 | Lg Electronics Lg WebOs 安全漏洞 | |
| CVE-2022-23730 | public API安全漏洞 | |
| CVE-2021-44620 | TotoLink A3100R 命令注入漏洞 | |
| CVE-2022-23926 | HP PC 安全漏洞 | |
| CVE-2021-46708 | swagger-ui-dist 安全漏洞 | |
| CVE-2022-26878 | Linux kernel安全漏洞 | |
| CVE-2022-26874 | Horde Groupware Webmail 跨站脚本漏洞 | |
| CVE-2020-36518 | FasterXML jackson-databind 缓冲区错误漏洞 | |
| CVE-2021-32472 | Moodle 信息泄露漏洞 | |
| CVE-2021-32476 | Moodle 资源管理错误漏洞 | |
| CVE-2021-32478 | Moodle 输入验证错误漏洞 |
Showing top 20 of 41 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: n/a
- CVE-2026-8276
bettercap MySQL Server mysql_server.go integer coercion - CVE-2026-8275
bettercap zerogod IPP Service zerogod_ipp_primitives.go ippR - CVE-2026-8270
Open5GS SMF ogs_nas_parse_qos_rules denial of service - CVE-2026-8269
Open5GS SMF smf_nsmf_handle_create_sm_context denial of serv - CVE-2026-8268
Open5GS SMF OpenAPI_list_create denial of service
V. Comments for CVE-2018-25031
No comments yet