Hoverfly
Monthly
Unauthenticated remote attackers can stream real-time application logs from Hoverfly API simulation tool (versions ≤1.11.3) via an unprotected WebSocket endpoint at /api/v2/ws/logs, exposing internal file paths, request/response bodies, and other sensitive operational data. Public exploit code exists (EPSS: 0.17%, percentile 38th - indicating low observed exploitation probability despite POC availability). Vendor-released patch available in version 1.12.0. Not listed in CISA KEV, suggesting limited widespread exploitation despite network-accessible attack surface with no authentication barrier.
Hoverfly API simulation tool version 1.11.3 and prior contains a command injection vulnerability in the middleware management endpoint /api/v2/hoverfly/middleware. Insufficient validation of user input allows authenticated attackers to execute arbitrary commands on the Hoverfly server.
Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated remote attackers can stream real-time application logs from Hoverfly API simulation tool (versions ≤1.11.3) via an unprotected WebSocket endpoint at /api/v2/ws/logs, exposing internal file paths, request/response bodies, and other sensitive operational data. Public exploit code exists (EPSS: 0.17%, percentile 38th - indicating low observed exploitation probability despite POC availability). Vendor-released patch available in version 1.12.0. Not listed in CISA KEV, suggesting limited widespread exploitation despite network-accessible attack surface with no authentication barrier.
Hoverfly API simulation tool version 1.11.3 and prior contains a command injection vulnerability in the middleware management endpoint /api/v2/hoverfly/middleware. Insufficient validation of user input allows authenticated attackers to execute arbitrary commands on the Hoverfly server.
Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.