Lucene search
Veracode Vulnerability DatabaseVERACODE:40029HistoryApr 04, 2023 - 8:05 a.m.
Information Disclosure
2023-04-0408:05:45
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
5
information disclosure
authenticated attacker
api keys
organisation id
client id
client version
resources
software
0.001 Low
EPSS
Percentile
21.0%
io.apiman: apiman-manager-api-rest-impl is vulnerable to Information Disclosure. An authenticated attacker is able to gain access to API keys they do not have permission for if they correctly guess the URL which includes Organisation ID, Client ID, and Client Version. Access to the non-permitted API Keys may allow use of other users’ resources without their permission.
| CPE | Name | Operator | Version |
|---|---|---|---|
| apiman-manager-api-rest-impl | le | 3.0.0.Final | |
| apiman-manager-api-rest-impl | le | 3.0.0.Final |
Related
nvd
nvd
CVE-2023-28640
2023-03-27 21:15:12
cve
cve
CVE-2023-28640
2023-03-27 21:15:12
osv
osv
Apiman vulnerable to permissions bypass due to missing check on API key URL
2023-03-27 22:17:57
CVE-2023-28640
2023-03-27 21:15:12
github
github
Apiman vulnerable to permissions bypass due to missing check on API key URL
2023-03-27 22:17:57
prion
prion
Design/Logic Flaw
2023-03-27 21:15:00
cvelist
cvelist