What is GHSA-62jr-84gf-wmg4?

GHSA-62jr-84gf-wmg4 is a security advisory published by GitHub Security Advisories with Medium severity. Default swagger-ui configuration exposes all files in the module

Which CVE IDs does GHSA-62jr-84gf-wmg4 cover?

GHSA-62jr-84gf-wmg4 covers the following CVE IDs: CVE-2024-22207. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-62jr-84gf-wmg4?

GHSA-62jr-84gf-wmg4 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-62jr-84gf-wmg4?

GHSA-62jr-84gf-wmg4 affects 1 product, including: npm/@fastify/swagger-ui:\u003e= 2.0.0, \u003c 2.1.0.

GHSA-62jr-84gf-wmg4MediumCVSS 5.3

Default swagger-ui configuration exposes all files in the module

Vendor

GitHub Security Advisories

Published

January 16, 2024

Last Modified

February 16, 2024

🔗 CVE IDs covered (1)

CVE-2024-22207 →

📋 Description

Impact

The default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module's directory being exposed via http routes served by the module.

Patches

Update to v2.1.0

Workarounds

Use the baseDir option

References

HackerOne report .

🎯 Affected products1

npm/@fastify/swagger-ui:>= 2.0.0, < 2.1.0

🔗 References (5)

https://github.com/fastify/fastify-swagger-ui/security/advisories/GHSA-62jr-84gf-wmg4
https://nvd.nist.gov/vuln/detail/CVE-2024-22207
https://github.com/fastify/fastify-swagger-ui/commit/13d799a2c5f14d3dd5b15892e03bbcbae63ee6f7
https://security.netapp.com/advisory/ntap-20240216-0002
https://github.com/advisories/GHSA-62jr-84gf-wmg4