CVE-2024-22207
Medium
Description
fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting the `baseDir` option can also work around this vulnerability.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Smartbear Swagger Ui
PublishedJan 15, 2024
First seenJan 15, 2024
Weakness typeCWE-1188CWE-1188
How to fix
Update
- smartbear swagger_ui2.1.0 or later
- @fastify/swagger-ui2.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| smartbear swagger_ui | 2.0.0 ≤ v < 2.1.0 | 2.1.0 |
| @fastify/swagger-uinpm | 2.0.0 ≤ v < 2.1.0 | 2.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.