CVE-2022-47551

Apiman has potential permissions bypass

References

• https://www.apiman.io/blog/permissions-bypass-disclosure/
• https://github.com/advisories/GHSA-54r5-wr8x-x5v3
• https://nvd.nist.gov/vuln/detail/CVE-2022-47551
• https://github.com/orgs/apiman/discussions/2409

Incorrect default permissions for certain read-only resources in the Apiman 1.5.7.Final through 2.2.3.Final in the Apiman Manager REST API allows a remote authenticated attacker to access information and resources in an Apiman Organizations they are not a member of and/or do not have permissions for.

For example, an attacker may be able to craft an HTTP request to discover APIs that are private to organizations they are not members of, via fuzzing, search, and other similar mechanisms.

If the attacker has sufficient permissions in their own organization, they may also be able to sign up to the private APIs they have discovered by crafting a tailored HTTP request, thereby gaining access to an API Management protected resource that they should have access to.

• A malicious account-holder may be able to see information about APIs they do not have permission for.

• A malicious account-holder may be able to sign up to APIs they do not have permission for, and hence access API Management-protected resources they are not authorized to access.

• This does NOT relate to the Apiman Gateway.

CVE-2022-47551 has a CVSS score of 7.1 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (3.0.0.Final); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

• Upgrade to Apiman 3.0.0.Final (or later). The issue is fixed in this version.

• If you are using an older version of Apiman, contact to your Apiman support provider for advice/long-term support.

1. What is CVE-2022-47551? CVE-2022-47551 is a high-severity security vulnerability in io.apiman:apiman-manager-api-rest-impl (maven), affecting versions >= 1.5.7, <= 2.2.3.Final. It is fixed in 3.0.0.Final.
2. How severe is CVE-2022-47551? CVE-2022-47551 has a CVSS score of 7.1 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of io.apiman:apiman-manager-api-rest-impl are affected by CVE-2022-47551? io.apiman:apiman-manager-api-rest-impl (maven) versions >= 1.5.7, <= 2.2.3.Final is affected.
4. Is there a fix for CVE-2022-47551? Yes. CVE-2022-47551 is fixed in 3.0.0.Final. Upgrade to this version or later.
5. Is CVE-2022-47551 exploitable, and should I be worried? Whether CVE-2022-47551 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2022-47551 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2022-47551? Upgrade io.apiman:apiman-manager-api-rest-impl to 3.0.0.Final or later.

Other vulnerabilities in io.apiman:apiman-manager-api-rest-impl