Insufficient Read Permission Checks in Apiman Manager REST API
Summary
GHSA-54r5-wr8x-x5v3: Duplicate Advisory: Apiman has insufficient checks for read permissions. Affects io.apiman:apiman-manager-api-rest-impl versions >= 1.5.7, < 3.0.0.Final. Fixed in 3.0.0.Final. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apiman is an open-source API management platform that provides a comprehensive set of tools for managing and securing APIs. The Apiman Manager REST API is a component of Apiman that allows users to interact with the API management system programmatically. It provides functionality for managing APIs, applications, and other resources. The Apiman Manager REST API is built using the io.apiman:apiman-manager-api-rest-impl package.
Vulnerability Detail
The Apiman Manager REST API in versions 1.5.7 through 2.2.3.Final has a vulnerability that allows malicious users to bypass read permissions and access private APIs they do not have permission for. This vulnerability can be exploited by a malicious user to gain unauthorized access to API Management-protected resources. The root cause of this vulnerability is the acceptance of a large contribution that was not fully compatible with the security model of Apiman versions before 3.0.0.Final. The vulnerability has been fixed in version 3.0.0.Final, which is not affected.
How To Fix
Minimum fixed version
3.0.0.Final
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version as soon as possible.
Conclusion
The Apiman Manager REST API in versions 1.5.7 through 2.2.3.Final has a vulnerability that allows unauthorized access to private APIs. It is recommended to upgrade to version 3.0.0.Final to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.apiman:apiman-manager-api-rest-impl →
FAQ
This vulnerability allows malicious users to access private APIs they do not have permission for, potentially exposing sensitive data or resources.
No, version 3.0.0.Final of Apiman is not affected by this vulnerability. The vulnerability has been fixed in this version.
There are no known exploits for this vulnerability at the time of this advisory.
Yes, this vulnerability can be exploited remotely by sending malicious requests to the Apiman Manager REST API.
Yes, the CVSS score for this vulnerability is 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Related vulnerabilities
Recent vulnerabilities recorded for io.apiman:apiman-manager-api-rest-impl.
