CWE-522 on ZAP

Exposed Secrets in Swagger/OpenAPI Path

Mon, 01 Jan 0001 00:00:00 +0000

Swagger UI endpoint exposes sensitive secrets such as client secrets, API keys, or OAuth tokens. These secrets may be accessible in the HTML source and should not be exposed publicly, as this can lead to compromise.

Vulnerable Swagger UI Version Detected

Mon, 01 Jan 0001 00:00:00 +0000

This Swagger UI version is known to contain vulnerabilities. Exploitation may allow unauthorized access, XSS, or token theft.

Affected versions:

Swagger UI v2 < 2.2.10
Swagger UI v3 < 3.24.3