CVE-2024-22371

Description

Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0. Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.

Reserved 2024-01-09 | Published 2024-02-26 | Updated 2024-10-31 | Assigner apache

Low

Problem types

Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data.

Product status

Default status
unaffected

1.x
unaffected

3.21.x
affected

3.22.x
affected

4.0.x
affected

4.x
affected

Credits

Otavio Rodolfo Piske from the Apache Software Foundation finder

References

camel.apache.org/security/CVE-2024-22371.html vendor-advisory

cve.org (CVE-2024-22371)

nvd.nist.gov (CVE-2024-22371)

Download JSON