rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OpenAPI (or Swagger) specification file of a project.
Metrics
Affected Vendors & Products
References
History
Thu, 31 Oct 2024 16:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2023-07-14T00:00:00
Updated: 2024-10-31T16:04:57.846Z
Reserved: 2023-07-14T00:00:00
Link: CVE-2023-38337
Vulnrichment
Updated: 2024-08-02T17:39:12.908Z
NVD
Status : Modified
Published: 2023-07-14T22:15:09.430
Modified: 2024-11-21T08:13:22.350
Link: CVE-2023-38337
Redhat
No data.