Vulnerability-Lookup

CVE-2024-22371 (GCVE-0-2024-22371)

Vulnerability from cvelistv5 – Published: 2024-02-26 09:22 – Updated: 2024-10-31 13:03

Title

Apache Camel issue on ExchangeCreatedEvent

Summary

Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0. Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.

Severity

2.9 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-05 14:48 UTC

CWE

Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data.
CWE-922 - Insecure Storage of Sensitive Information

Assigner

apache mitre root

References

1 reference

URL	Tags
https://camel.apache.org/security/CVE-2024-22371.html	vendor-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
Apache Software Foundation	Apache Camel	Unaffected: 1.x , ≤ 1.6.0 (semver) Affected: 3.21.x , ≤ 3.21.3 (semver) Affected: 3.22.x , ≤ 3.22.0 (semver) Affected: 4.0.x , ≤ 4.0.3 (semver) Affected: 4.x , ≤ 4.3.0 (semver)	guessed

Credits

Otavio Rodolfo Piske from the Apache Software Foundation

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:43:34.525Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://camel.apache.org/security/CVE-2024-22371.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22371",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-05T14:48:22.345763Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-922",
                "description": "CWE-922 Insecure Storage of Sensitive Information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-31T13:03:53.000Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Camel",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.6.0",
              "status": "unaffected",
              "version": "1.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.21.3",
              "status": "affected",
              "version": "3.21.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.22.0",
              "status": "affected",
              "version": "3.22.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.0.3",
              "status": "affected",
              "version": "4.0.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.0",
              "status": "affected",
              "version": "4.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Otavio Rodolfo Piske from the Apache Software Foundation"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.\u003cp\u003eThis issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.\n\nUsers are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Low"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data.",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-26T09:22:38.384Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://camel.apache.org/security/CVE-2024-22371.html"
        }
      ],
      "source": {
        "defect": [
          "CAMEL-20305"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Apache Camel issue on ExchangeCreatedEvent",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-22371",
    "datePublished": "2024-02-26T09:22:38.384Z",
    "dateReserved": "2024-01-09T12:04:27.624Z",
    "dateUpdated": "2024-10-31T13:03:53.000Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-22371",
      "date": "2026-09-14",
      "epss": "0.00695",
      "percentile": "0.51019"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.\\n\\nUsers are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.\\n\\n\"}, {\"lang\": \"es\", \"value\": \"Exposici\\u00f3n de datos confidenciales mediante la creaci\\u00f3n de un EventFactory malicioso y proporcionando un ExchangeCreatedEvent personalizado que expone datos confidenciales. Vulnerabilidad en Apache Camel. Este problema afecta a Apache Camel: desde 3.21.X hasta 3.21.3, desde 3.22.X hasta 3.22.0, desde 4.0.X hasta 4.0.3, desde 4.X hasta 4.3.0. Se recomienda a los usuarios actualizar a la versi\\u00f3n 3.21.4, 3.22.1, 4.0.4 o 4.4.0, que soluciona el problema.\"}]",
      "id": "CVE-2024-22371",
      "lastModified": "2024-11-21T08:56:08.540",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@apache.org\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 2.9, \"baseSeverity\": \"LOW\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.4, \"impactScore\": 1.4}]}",
      "published": "2024-02-26T16:27:56.557",
      "references": "[{\"url\": \"https://camel.apache.org/security/CVE-2024-22371.html\", \"source\": \"security@apache.org\"}, {\"url\": \"https://camel.apache.org/security/CVE-2024-22371.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security@apache.org",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-922\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-22371\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2024-02-26T16:27:56.557\",\"lastModified\":\"2026-06-17T07:11:16.430\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.\\n\\nUsers are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.\\n\\n\"},{\"lang\":\"es\",\"value\":\"Exposici\u00f3n de datos confidenciales mediante la creaci\u00f3n de un EventFactory malicioso y proporcionando un ExchangeCreatedEvent personalizado que expone datos confidenciales. Vulnerabilidad en Apache Camel. Este problema afecta a Apache Camel: desde 3.21.X hasta 3.21.3, desde 3.22.X hasta 3.22.0, desde 4.0.X hasta 4.0.3, desde 4.X hasta 4.3.0. Se recomienda a los usuarios actualizar a la versi\u00f3n 3.21.4, 3.22.1, 4.0.4 o 4.4.0, que soluciona el problema.\"}],\"affected\":[{\"source\":\"security@apache.org\",\"affectedData\":[{\"vendor\":\"Apache Software Foundation\",\"product\":\"Apache Camel\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"1.x\",\"lessThanOrEqual\":\"1.6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"3.21.x\",\"lessThanOrEqual\":\"3.21.3\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.22.x\",\"lessThanOrEqual\":\"3.22.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.0.x\",\"lessThanOrEqual\":\"4.0.3\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.x\",\"lessThanOrEqual\":\"4.3.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":2.9,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.4,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-08-05T14:48:22.345763Z\",\"id\":\"CVE-2024-22371\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-922\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0\",\"versionEndExcluding\":\"3.21.4\",\"matchCriteriaId\":\"538BED08-EC3A-4994-AD1C-2E55AF256D72\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:*:-:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0.0\",\"versionEndExcluding\":\"4.0.4\",\"matchCriteriaId\":\"0D74033D-CA38-4898-AAF5-9A326272C684\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.1.0\",\"versionEndExcluding\":\"4.4.0\",\"matchCriteriaId\":\"27A2B9B3-E722-442D-81B4-F2DE97C328FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:3.22.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA31037D-507A-42D5-97BE-E57A85C9FF4F\"}]}]}],\"references\":[{\"url\":\"https://camel.apache.org/security/CVE-2024-22371.html\",\"source\":\"security@apache.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://camel.apache.org/security/CVE-2024-22371.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-05T05:08:37+00:00",
      "cve": "CVE-2024-22371",
      "id": "CVE-2024-22371",
      "initial_release_date": "2024-02-23T00:00:00+00:00",
      "product_status:fixed": "26",
      "product_status:known_affected": "9",
      "product_status:known_not_affected": "7",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "camel-core: Exposure of sensitive data by crafting a malicious EventFactory",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-22371.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://camel.apache.org/security/CVE-2024-22371.html\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T22:43:34.525Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-22371\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-05T14:48:22.345763Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-922\", \"description\": \"CWE-922 Insecure Storage of Sensitive Information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-05T15:10:21.153Z\"}}], \"cna\": {\"title\": \"Apache Camel issue on ExchangeCreatedEvent\", \"source\": {\"defect\": [\"CAMEL-20305\"], \"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Otavio Rodolfo Piske from the Apache Software Foundation\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 2.9, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"Low\"}]}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Camel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1.x\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.6.0\"}, {\"status\": \"affected\", \"version\": \"3.21.x\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.21.3\"}, {\"status\": \"affected\", \"version\": \"3.22.x\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.22.0\"}, {\"status\": \"affected\", \"version\": \"4.0.x\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.0.3\"}, {\"status\": \"affected\", \"version\": \"4.x\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.3.0\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://camel.apache.org/security/CVE-2024-22371.html\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.\\n\\nUsers are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.\u003cp\u003eThis issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data.\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2024-02-26T09:22:38.384Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-22371\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-31T13:03:53.000Z\", \"dateReserved\": \"2024-01-09T12:04:27.624Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2024-02-26T09:22:38.384Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CNVD-2024-26185

Vulnerability from cnvd - Published: 2024-06-06

Title

Apache Camel存在未明漏洞（CNVD-2024-26185）

Description

Apache Camel是美国阿帕奇（Apache）基金会的一套开源的基于Enterprise Integration Pattern(企业整合模式，简称EIP)的集成框架。该框架提供企业集成模式的Java对象（POJO）的实现，且通过应用程序接口来配置路由和中介的规则。 Apache Camel存在安全漏洞，攻击者可利用该漏洞通过制作恶意EventFactory来暴露敏感数据。

Severity

低

Patch Name

Apache Camel存在未明漏洞（CNVD-2024-26185）的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://camel.apache.org/security/CVE-2024-22371.html

Reference

https://nvd.nist.gov/vuln/detail/CVE-2024-22371

Impacted products

Name
['Apache Camel <3.21.4', 'Apache Camel <3.22.1', 'Apache Camel <4.0.4', 'Apache Camel <4.1.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-22371",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-22371"
    }
  },
  "description": "Apache Camel\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u5f00\u6e90\u7684\u57fa\u4e8eEnterprise Integration Pattern(\u4f01\u4e1a\u6574\u5408\u6a21\u5f0f\uff0c\u7b80\u79f0EIP)\u7684\u96c6\u6210\u6846\u67b6\u3002\u8be5\u6846\u67b6\u63d0\u4f9b\u4f01\u4e1a\u96c6\u6210\u6a21\u5f0f\u7684Java\u5bf9\u8c61\uff08POJO\uff09\u7684\u5b9e\u73b0\uff0c\u4e14\u901a\u8fc7\u5e94\u7528\u7a0b\u5e8f\u63a5\u53e3\u6765\u914d\u7f6e\u8def\u7531\u548c\u4e2d\u4ecb\u7684\u89c4\u5219\u3002\n\nApache Camel\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u5236\u4f5c\u6076\u610fEventFactory\u6765\u66b4\u9732\u654f\u611f\u6570\u636e\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://camel.apache.org/security/CVE-2024-22371.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-26185",
  "openTime": "2024-06-06",
  "patchDescription": "Apache Camel\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u5f00\u6e90\u7684\u57fa\u4e8eEnterprise Integration Pattern(\u4f01\u4e1a\u6574\u5408\u6a21\u5f0f\uff0c\u7b80\u79f0EIP)\u7684\u96c6\u6210\u6846\u67b6\u3002\u8be5\u6846\u67b6\u63d0\u4f9b\u4f01\u4e1a\u96c6\u6210\u6a21\u5f0f\u7684Java\u5bf9\u8c61\uff08POJO\uff09\u7684\u5b9e\u73b0\uff0c\u4e14\u901a\u8fc7\u5e94\u7528\u7a0b\u5e8f\u63a5\u53e3\u6765\u914d\u7f6e\u8def\u7531\u548c\u4e2d\u4ecb\u7684\u89c4\u5219\u3002\r\n\r\nApache Camel\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u5236\u4f5c\u6076\u610fEventFactory\u6765\u66b4\u9732\u654f\u611f\u6570\u636e\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Camel\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2024-26185\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apache Camel \u003c3.21.4",
      "Apache Camel \u003c3.22.1",
      "Apache Camel \u003c4.0.4",
      "Apache Camel \u003c4.1.0"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2024-22371",
  "serverity": "\u4f4e",
  "submitTime": "2024-03-14",
  "title": "Apache Camel\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2024-26185\uff09"
}

FKIE_CVE-2024-22371

Vulnerability from fkie_nvd - Published: 2024-02-26 16:27 - Updated: 2026-06-17 07:11

Severity

2.9 (Low) - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security@apache.org	https://camel.apache.org/security/CVE-2024-22371.html	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://camel.apache.org/security/CVE-2024-22371.html	Vendor Advisory

Impacted products

Vendor	Product	Version
apache	camel	*
apache	camel	*
apache	camel	*
apache	camel	3.22.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Camel",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.6.0",
              "status": "unaffected",
              "version": "1.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.21.3",
              "status": "affected",
              "version": "3.21.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.22.0",
              "status": "affected",
              "version": "3.22.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.0.3",
              "status": "affected",
              "version": "4.0.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.0",
              "status": "affected",
              "version": "4.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "538BED08-EC3A-4994-AD1C-2E55AF256D72",
              "versionEndExcluding": "3.21.4",
              "versionStartIncluding": "3.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:camel:*:-:*:*:*:*:*:*",
              "matchCriteriaId": "0D74033D-CA38-4898-AAF5-9A326272C684",
              "versionEndExcluding": "4.0.4",
              "versionStartIncluding": "4.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "27A2B9B3-E722-442D-81B4-F2DE97C328FB",
              "versionEndExcluding": "4.4.0",
              "versionStartIncluding": "4.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:camel:3.22.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA31037D-507A-42D5-97BE-E57A85C9FF4F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.\n\nUsers are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.\n\n"
    },
    {
      "lang": "es",
      "value": "Exposici\u00f3n de datos confidenciales mediante la creaci\u00f3n de un EventFactory malicioso y proporcionando un ExchangeCreatedEvent personalizado que expone datos confidenciales. Vulnerabilidad en Apache Camel. Este problema afecta a Apache Camel: desde 3.21.X hasta 3.21.3, desde 3.22.X hasta 3.22.0, desde 4.0.X hasta 4.0.3, desde 4.X hasta 4.3.0. Se recomienda a los usuarios actualizar a la versi\u00f3n 3.21.4, 3.22.1, 4.0.4 o 4.4.0, que soluciona el problema."
    }
  ],
  "id": "CVE-2024-22371",
  "lastModified": "2026-06-17T07:11:16.430",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 2.9,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.4,
        "impactScore": 1.4,
        "source": "security@apache.org",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-22371",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-08-05T14:48:22.345763Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-02-26T16:27:56.557",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://camel.apache.org/security/CVE-2024-22371.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://camel.apache.org/security/CVE-2024-22371.html"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-922"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-QPXM-689R-3849

Vulnerability from github – Published: 2024-02-26 18:30 – Updated: 2024-10-31 16:57

Summary

Apache Camel data exposure vulnerability

Details

Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel. This issue affects Apache Camel: from 3.0.0 through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.

Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.

Severity

2.9 (Low)


                  
                    CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.21.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.22.0"
            },
            {
              "fixed": "3.22.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.22.0"
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.0"
            },
            {
              "fixed": "4.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-22371"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-922"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-26T21:30:37Z",
    "nvd_published_at": "2024-02-26T16:27:56Z",
    "severity": "LOW"
  },
  "details": "Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel. This issue affects Apache Camel: from 3.0.0 through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.\n\nUsers are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.\n\n",
  "id": "GHSA-qpxm-689r-3849",
  "modified": "2024-10-31T16:57:20Z",
  "published": "2024-02-26T18:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22371"
    },
    {
      "type": "WEB",
      "url": "https://camel.apache.org/security/CVE-2024-22371.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/camel"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/CAMEL-20305"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Camel data exposure vulnerability"
}

GSD-2024-22371

Vulnerability from gsd - Updated: 2024-01-10 06:02

Details

Aliases

CVE-2024-22371

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-22371"
      ],
      "details": "Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.\n\nUsers are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.\n\n",
      "id": "GSD-2024-22371",
      "modified": "2024-01-10T06:02:20.841296Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@apache.org",
        "ID": "CVE-2024-22371",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Apache Camel",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unaffected",
                            "versions": [
                              {
                                "lessThanOrEqual": "1.6.0",
                                "status": "unaffected",
                                "version": "1.x",
                                "versionType": "semver"
                              },
                              {
                                "lessThanOrEqual": "3.21.3",
                                "status": "affected",
                                "version": "3.21.x",
                                "versionType": "semver"
                              },
                              {
                                "lessThanOrEqual": "3.22.0",
                                "status": "affected",
                                "version": "3.22.x",
                                "versionType": "semver"
                              },
                              {
                                "lessThanOrEqual": "4.0.3",
                                "status": "affected",
                                "version": "4.0.x",
                                "versionType": "semver"
                              },
                              {
                                "lessThanOrEqual": "4.3.0",
                                "status": "affected",
                                "version": "4.x",
                                "versionType": "semver"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Apache Software Foundation"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Otavio Rodolfo Piske from the Apache Software Foundation"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.\n\nUsers are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.\n\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data."
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://camel.apache.org/security/CVE-2024-22371.html",
            "refsource": "MISC",
            "url": "https://camel.apache.org/security/CVE-2024-22371.html"
          }
        ]
      },
      "source": {
        "defect": [
          "CAMEL-20305"
        ],
        "discovery": "INTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.\n\nUsers are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.\n\n"
          }
        ],
        "id": "CVE-2024-22371",
        "lastModified": "2024-02-26T16:32:25.577",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 2.9,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.4,
              "impactScore": 1.4,
              "source": "security@apache.org",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-02-26T16:27:56.557",
        "references": [
          {
            "source": "security@apache.org",
            "url": "https://camel.apache.org/security/CVE-2024-22371.html"
          }
        ],
        "sourceIdentifier": "security@apache.org",
        "vulnStatus": "Awaiting Analysis"
      }
    }
  }
}

RHSA-2024:4057

Vulnerability from csaf_redhat - Published: 2024-06-24 01:38 - Updated: 2026-09-11 01:11

Summary

Red Hat Security Advisory: Release of OpenShift Serverless Logic 1.33.0 security update & enhancements

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2024-22371.

CVE-2024-22371

A flaw was found in Apache Camel. This issue may allow an attacker to expose sensitive data by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent.

2.9 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Fixed: 26 products

https://access.redhat.com/errata/RHSA-2024:4057

Open the full advisory

RHSA-2024_4057

Vulnerability from csaf_redhat - Published: 2024-06-24 01:38 - Updated: 2024-12-17 02:00

Summary

Red Hat Security Advisory: Release of OpenShift Serverless Logic 1.33.0 security update & enhancements

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2024-22371.

CVE-2024-22371

A flaw was found in Apache Camel. This issue may allow an attacker to expose sensitive data by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent.

2.9 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Fixed: 26 products

https://access.redhat.com/errata/RHSA-2024:4057

Open the full advisory

WID-SEC-W-2024-0422

Vulnerability from csaf_certbund - Published: 2024-02-19 23:00 - Updated: 2024-06-23 22:00

Summary

Apache Camel: Schwachstelle ermöglicht Offenlegung von Informationen

Severity

Mittel

Scope

1 vulnerability in this advisory, including CVE-2024-22371.

CVE-2024-22371

Es besteht eine Schwachstelle in Apache Camel. Dieser Fehler besteht in der Komponente EventFactory, die es einem entfernten, anonymen Angreifer ermöglicht, diese Schwachstelle auszunutzen, um vertrauliche Informationen offenzulegen.

Known affected: 2 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2024-22371 (GCVE-0-2024-22371)

CNVD-2024-26185

FKIE_CVE-2024-22371

GHSA-QPXM-689R-3849

GSD-2024-22371

RHSA-2024:4057

RHSA-2024_4057

WID-SEC-W-2024-0422

Tags

Sightings

Nomenclature