CVE-2024-22371
published 2024-02-26CVE-2024-22371: Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.69%
48.8th percentile
Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.
Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | camel | — | — |
| apache | camel | — | — |
| apache | camel | >= 3.0.0 < 3.21.4 | 3.21.4 |
| apache | camel | >= 4.0.0 < 4.0.4 | 4.0.4 |
| apache | camel | >= 4.1.0 < 4.4.0 | 4.4.0 |
| apache_software_foundation | apache_camel | 3.21.x – 3.21.3 | — |
| apache_software_foundation | apache_camel | 3.22.x – 3.22.0 | — |
| apache_software_foundation | apache_camel | 4.0.x – 4.0.3 | — |
| apache_software_foundation | apache_camel | 4.x – 4.3.0 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_apache2.9LOW
vendor_redhat2.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
camel-core: Exposure of sensitive data by crafting a malicious EventFactory
vendor_redhat·2024-02-23·CVSS 2.9
CVE-2024-22371 [LOW] CWE-201 camel-core: Exposure of sensitive data by crafting a malicious EventFactory
camel-core: Exposure of sensitive data by crafting a malicious EventFactory
Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.
Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.
A flaw was found in Apache Camel. This issue may allow an attacker to expose sensitive data by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent.
Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security cr
Apache
Apache camel: CVE-2024-22371
vendor_apache·CVSS 2.9
CVE-2024-22371 [LOW] Apache camel: CVE-2024-22371
Apache camel: CVE-2024-22371
From 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0 3.21.4, 3.22.1, 4.0.4 and 4.4.0 LOW Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data
Severity: low
OSV
Apache Camel data exposure vulnerability
osv·2024-02-26
CVE-2024-22371 [LOW] Apache Camel data exposure vulnerability
Apache Camel data exposure vulnerability
Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel. This issue affects Apache Camel: from 3.0.0 through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.
Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.
GHSA
Apache Camel data exposure vulnerability
ghsa·2024-02-26
CVE-2024-22371 [LOW] CWE-200 Apache Camel data exposure vulnerability
Apache Camel data exposure vulnerability
Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel. This issue affects Apache Camel: from 3.0.0 through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.
Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.
No detection rules found.
No public exploits indexed.
2024-02-26
Published