CVE-2023-38337.yml

---
gem: rswag
cve: 2023-38337
ghsa: vc79-65pr-q82v
url: https://github.com/rswag/rswag/issues/653
title: rswag vulnerable to arbitrary JSON and YAML file read via directory traversal
date: 2023-07-15
description: |
  rswag before 2.10.1 allows remote attackers to read arbitrary JSON and
  YAML files via directory traversal, because rswag-api can expose a file that is
  not the OpenAPI (or Swagger) specification file of a project.
cvss_v3: 7.5
patched_versions:
  - ">= 2.10.1"
related:
  url:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38337
    - https://github.com/rswag/rswag/issues/653
    - https://github.com/rswag/rswag/compare/2.9.0...2.10.1
    - https://github.com/advisories/GHSA-vc79-65pr-q82v