CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2024-22371
High (7.5) in apache camel. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in org.apache.camel:camel-core 3.21.4, 3.22.1, 4.0.4.
Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.
Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
- CWE
- CWE-922
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:camel
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qpxm-689r-3849 | Maven | org.apache.camel:camel-core | >=3.0.0 <3.21.4 | 3.21.4 |
| GHSA-qpxm-689r-3849 | Maven | org.apache.camel:camel-core | >=3.22.0 <3.22.1 | 3.22.1 |
| GHSA-qpxm-689r-3849 | Maven | org.apache.camel:camel-core | >=4.0.0 <4.0.4 | 4.0.4 |
| GHSA-qpxm-689r-3849 | Maven | org.apache.camel:camel-core | >=4.1.0 <4.4.0 | 4.4.0 |