Read the docs
TI-2022-23609 Aliases CVE-2022-47551GHSA-j94p-hv25-rm5g

Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the…

Priority LOW 30CWE-276Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. The root cause of the issue is the Apiman project's accidental acceptance of a large contribution that was not fully compatible with the security model of Apiman versions before 3.0.0.Final. Because of this, 3.0.0.Final is not affected by the vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00644 51st percentileScored 2026-11-07
Fix Fixed io.apiman:apiman-manager-api-rest-impl (Maven): 3.0.0.Final

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—io.apiman:apiman-manager-api-rest-impl (Maven)1.5.7 to before 3.0.0.Final3.0.0.FinalPatch availableGHSA-j94p-hv25-rm5g
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • io.apiman:apiman-manager-api-rest-impl (Maven) Vendor— Affected 1.5.7 to before 3.0.0.Final Fixed in 3.0.0.Final Patch available GHSA-j94p-hv25-rm5g

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apiman:apiman:*:*:*:*:*:*:*:*1.5.7 – 2.2.3Vulnerableapiman
  • cpe:2.3:a:apiman:apiman:*:*:*:*:*:*:*:* Versions 1.5.7 – 2.2.3 Vulnerable ·apiman

Remediation

  • Fix · GHSA-j94p-hv25-rm5g io.apiman:apiman-manager-api-rest-impl (Maven) Fixed in 3.0.0.Final Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-47551
  2. 2026-10-03 Alias added: GHSA-j94p-hv25-rm5g
  3. 2026-10-21 EPSS moved to the 50th–90th percentile

References

Advisory 4

Other 4

  • TI-2023-13159 Permissions bypass in Apiman could enable authenticated attacker to unpermitted API Key CVSS 3.1MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences