CVE-2024-22371

Apache Camel issue on ExchangeCreatedEvent

State: Published
Severity: 2.9 Low
Published: Feb 26, 2024
Updated: Oct 31, 2024
Reserved: Jan 9, 2024

Description

Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.

Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	2.9 Low	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N	apache

Weaknesses

CWE-922 Insecure Storage of Sensitive Information

Affected Products

Product	Versions
Apache CamelApache Software Foundation	1.x through 1.6.0Not affected 3.21.x through 3.21.3Affected 3.22.x through 3.22.0Affected 4.0.x through 4.0.3Affected 4.x through 4.3.0Affected

References

https://camel.apache.org/security/CVE-2024-22371.htmlvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.