CVE-2024-22207

    Dashboard / Vulnerabilities / CVE-2024-22207

    CVE-2024-22207

    Published: 15 Jan 2024Last Modified: 28 Oct 2026

    Summary: Default swagger-ui configuration exposes all files in the module

    Details: fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting the `baseDir` option can also work around this vulnerability.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22207.json, https://github.com/fastify/fastify-swagger-ui/security/advisories/GHSA-62jr-84gf-wmg4, https://nvd.nist.gov/vuln/detail/CVE-2024-22207, https://security.netapp.com/advisory/ntap-20240216-0002/, https://github.com/fastify/fastify-swagger-ui/commit/13d799a2c5f14d3dd5b15892e03bbcbae63ee6f7

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -7aaad5ae38fb21cd9c5eea73722d5981bdb2e848

    Affected versions

    v2.0.1
    v2.0.24
    v2.0.22
    v2.0.21
    v2.0.20
    v2.0.19
    v2.0.18
    v2.0.17
    v2.0.16
    v2.0.15
    v2.0.14
    v2.0.12
    v2.0.11
    v2.0.10
    v2.0.9
    v2.0.8
    v2.0.7
    v2.0.4
    v2.0.3
    v2.0.2
    v2.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-22207 | CVE-DB