CVE-2022-47551

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. The root cause of the issue is the Apiman project's accidental acceptance of a large contribution that was not fully compatible with the security model of Apiman versions before 3.0.0.Final. Because of this, 3.0.0.Final is not affected by the vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.apiman.io/blog/permissions-bypass-disclosure/Vendor Advisory
https://www.github.com/apiman/apimanThird Party Advisory
https://www.apiman.io/blog/permissions-bypass-disclosure/Vendor Advisory
https://www.github.com/apiman/apimanThird Party Advisory

Timeline

Published: Dec 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-475537.5Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the o CVE-2022-475547.5Exposure of sensitive information in ekorCCP and ekorRCI, potentially allowing a remote attacker to obtain critical information from various CVE-2022-475558.8Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users CVE-2022-475566.5Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimat CVE-2022-475576.1Vulnerability in ekorCCP and ekorRCI that could allow an attacker with access to the network where the device is located to decrypt the cred CVE-2022-475589.8Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability ca CVE-2022-475598.8Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious act CVE-2022-47565.4The My YouTube Channel WordPress plugin before 3.23.0 does not validate and escape some of its shortcode attributes before outputting them b CVE-2022-475606.5The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom requests to execute malicious ac CVE-2022-475615.5The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which CVE-2022-475627.5Vulnerability in the RCPbind service running on UDP port (111), allowing a remote attacker to create a denial of service (DoS) condition.CVE-2022-47575.4The List Pages Shortcode WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them