CVE-2022-47551: Apiman has insufficient checks for read permissions

December 20, 2022

Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. The root cause of the issue is the Apiman project’s accidental acceptance of a large contribution that was not fully compatible with the security model of Apiman versions before 3.0.0.Final. Because of this, 3.0.0.Final is not affected by the vulnerability.

References

github.com/advisories/GHSA-54r5-wr8x-x5v3
github.com/apiman/apiman/discussions/2409
nvd.nist.gov/vuln/detail/CVE-2022-47551
www.apiman.io/blog/permissions-bypass-disclosure/
www.github.com/apiman/apiman

Code Behaviors & Features

Detect and mitigate CVE-2022-47551 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →