-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.apiman:apiman-manager-api-rest-impl | maven | < 3.0.0.Final | 3.1.0.Final |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing authorization checks when accessing API keys via a URL containing organization/client/version parameters. In REST API implementations like Apiman, endpoint handlers (e.g., ClientResourceImpl) would typically enforce permissions before returning sensitive data like API keys. The function handling GET requests for API keys (getApiKey) likely lacked these checks in vulnerable versions, allowing unauthorized access if attackers guessed valid URL parameters. This matches the CWE-862 (Missing Authorization) description and the vulnerability's URL-based exploitation pattern.
Ongoing coverage of React2Shell