Vulnerability · Published Dec 19, 2022 · Assigned by mitre
CVE-2022-47551
Medium 6.5
In plain English
A medium-severity incorrect default permissions in the io.apiman:apiman-manager-api-rest-impl package (Maven). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. The root cause of the issue is the Apiman project's accidental acceptance of a large contribution that was not fully compatible with the security model of Apiman versions before 3.0.0.Final. Because of this, 3.0.0.Final is not affected by the vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | io.apiman:apiman-manager-api-rest-impl | 3.0.0.Final | GHSA-j94p-hv25-rm5g |
Affected products (as reported)
Weakness: CWE-276 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N