CVE-2017-1000207

Description

A vulnerability in Swagger-Parsers version <= 1.0.30 and Swagger codegen version <= 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the generate and validate command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification.

Risk Information

Base Score

8.8

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.423

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2017-1000208,CVE-2017-1000207 are fixed in Swagger - Codegen 2.2.2	Windows
Vulnerabilities CVE-2017-1000208,CVE-2017-1000207 are fixed in Swagger-swagger-parser 1.0.31	Windows
Vulnerabilities CVE-2017-1000208,CVE-2017-1000207 are fixed in Swagger - Codegen for Linux 2.2.2	Linux
Vulnerabilities CVE-2017-1000208,CVE-2017-1000207 are fixed in Swagger-swagger-parser for Linux 1.0.31	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234