GitHub Advisoryadvisory · Maven

GHSA-qpxm-689r-3849 Apache Camel data exposure vulnerability

LOW Published 2024-02-26 Modified 2024-10-31 Official page ↗
Aliases
CVE-2024-22371
Ecosystem
Maven
Packages
org.apache.camel:camel-core
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-922
Reviewed
2024-02-26

Affected packages

• Maven org.apache.camel:camel-core: >= 3.0.0, < 3.21.4 → fixed in 3.21.4 • Maven org.apache.camel:camel-core: >= 3.22.0, < 3.22.1 → fixed in 3.22.1 • Maven org.apache.camel:camel-core: >= 4.0.0, < 4.0.4 → fixed in 4.0.4 • Maven org.apache.camel:camel-core: >= 4.1.0, < 4.4.0 → fixed in 4.4.0

Description

Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel. This issue affects Apache Camel: from 3.0.0 through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0. Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2024-22371 Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-922 Insecure Storage of Sensitive Information weakness

References