CVE-2024-22207
Default swagger-ui configuration exposes all files in the module
概要
Default swagger-ui configuration exposes all files in the module
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting the baseDir option can also work around this vulnerability.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- patch github.com