Vulnerability record · CVE-2024-22207 · published 15 January 2024

CVE-2024-22207: Smartbear swagger ui insecure default initialization vulnerability

Smartbear · Swagger Ui

fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting the `baseDir` option can also work around this vulnerability.

5.3 CVSS 3.1 Medium EPSS 2.3% · top 17.5% CWE-1188 · Insecure default initialization

5.3CVSS 3.1 base score

2.3%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Swagger Ui Smartbear

References

Link	Tags
https://github.com/fastify/fastify-swagger-ui/commit/13d799a2c5f14d3dd5b15892e03bbcbae63ee6f7	Patch
https://github.com/fastify/fastify-swagger-ui/security/advisories/GHSA-62jr-84gf-wmg4	Vendor Advisory
https://security.netapp.com/advisory/ntap-20240216-0002/
https://github.com/fastify/fastify-swagger-ui/commit/13d799a2c5f14d3dd5b15892e03bbcbae63ee6f7	Patch
https://github.com/fastify/fastify-swagger-ui/security/advisories/GHSA-62jr-84gf-wmg4	Vendor Advisory
https://security.netapp.com/advisory/ntap-20240216-0002/

Track CVE-2024-22207 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-17495Smartbear swagger ui cross-site request forgery vulnerabilityA Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) techniq…EPSS 5.7%10 Oct 2019 4.3CVE-2018-25031Smartbear swagger ui improper input validation vulnerabilitySwagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker cou…EPSS 42%11 Mar 2022 5.3CVE-2025-48927TeleMessage Spring Boot Actuator heap dump endpoint exposed by insecure defaultTeleMessage through 2025-05-05 ships with Spring Boot Actuator configured to expose the /heapdump endpoint. Because this is an insecure default initi…KEVEPSS 11%analysed28 May 2025 9.8CVE-2023-27524Apache Superset default SECRET_KEY allows session forgery and auth bypassApache Superset versions up to and including 2.0.1 ship with a default SECRET_KEY that, if left unchanged, lets an attacker forge signed session cook…KEVEPSS 97%analysed24 Apr 2023 9.8CVE-2023-6448Unitronics VisiLogic default admin password in Vision and Samba PLCs/HMIsUnitronics VisiLogic before 9.9.00, used with Vision and Samba PLCs and HMIs, ships with a default administrative password. Because the credential is…KEVEPSS 2.1%analysed5 Dec 2023 9.8CVE-2022-24706Apache CouchDB default install allows unauthenticated admin accessApache CouchDB before 3.2.2 ships with an insecure default initialization that lets an unauthenticated attacker reach an improperly secured installat…KEVEPSS 93%analysed26 Apr 2022 9.8CVE-2020-13927Apache Airflow Experimental API missing authentication by defaultAirflow's Experimental API defaulted to allowing all requests without authentication, so any reachable instance exposed its API to unauthenticated ca…KEVEPSS 100%analysed10 Nov 2020

Source: NIST National Vulnerability Database (record CVE-2024-22207), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.