RubyGems/rswag CVE-2023-38337: high 7.5, EPSS 1.27%

rswag vulnerable to arbitrary JSON and YAML file read via directory traversal

Action: Upgrade rswag to 2.10.1 or later.

bundle update rswag

Affected

Fixed versions

Sources

• osv: GHSA-vc79-65pr-q82v
• https://nvd.nist.gov/vuln/detail/CVE-2023-38337
• https://github.com/rswag/rswag/issues/653
• https://github.com/rswag/rswag
• https://github.com/rswag/rswag/compare/2.9.0...2.10.1
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rswag/CVE-2023-38337.yml

CVE-2023-38337 · published 2023-07-15T00:30:34Z · modified 2024-02-16T08:14:13.686927Z · JSON