CVE-2022-47551 json
Apiman has potential permissions bypass
published 2022-12-19 3 y ago modified 2026-06-17 4 mo ago also GHSA-j94p-hv25-rm5g , EUVD-2023-0494
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. The root cause of the issue is the Apiman project's accidental acceptance of a large contribution that was not fully compatible with the security model of Apiman versions before 3.0.0.Final. Because of this, 3.0.0.Final is not affected by the vulnerability.
Patch / fix
- maven io.apiman:apiman-manager-api-rest-impl 3.0.0.Final
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.64% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | io.apiman:apiman-manager-api-rest-impl | >=1.5.7, <3.0.0.Final |
3.0.0.Final |
Classification
- Weakness
-
- CWE-276 Incorrect Default Permissions
References
-
apiman.io
/blog/permissions-bypass-disclosure/
vendor-advisory
-
github.com
/apiman/apiman
third-party-advisory
-
github.com
/apiman/apiman/security/advisories/GHSA-j94p-hv25-rm5g
web
-
nvd.nist.gov
/vuln/detail/CVE-2022-47551
advisory
-
github.com
/advisories/GHSA-54r5-wr8x-x5v3
advisory
-
github.com
/apiman/apiman
package
-
github.com
/orgs/apiman/discussions/2409
web
-
apiman.io
/blog/permissions-bypass-disclosure
web
Sources
- CVE List CVE-2022-47551
- GitHub Advisory GHSA-j94p-hv25-rm5g
- NVD CVE-2022-47551
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.