# CVE-2018-25031

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.

- Page: https://www.vulneraibility.com/cve/CVE-2018-25031
- CVSS: 4.3
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 42.33% (percentile 98.7)
- Unvetted proof-of-concept code on GitHub: 15 GitHub proofs of concept (first 2022-05-26)
- CISA SSVC: exploitation poc, automatable no, technical impact partial (assessed 2024-07-18)
- Weakness: CWE-922, CWE-918, CWE-20
- Published: 2022-03-11

## Affected

- smartbear:swagger_ui

## References

- [other] https://security.snyk.io/vuln/SNYK-JS-SWAGGERUI-2314885
- [other] https://github.com/swagger-api/swagger-ui/issues/4872
- [other] https://github.com/swagger-api/swagger-ui/releases/tag/v4.1.3
- [other] https://security.netapp.com/advisory/ntap-20220407-0004/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.