cnvd - cnvd-2024-26185

cnvd-2024-26185

Vulnerability from cnvd

Title: Apache Camel存在未明漏洞（CNVD-2024-26185）

Description:

Apache Camel是美国阿帕奇（Apache）基金会的一套开源的基于Enterprise Integration Pattern(企业整合模式，简称EIP)的集成框架。该框架提供企业集成模式的Java对象（POJO）的实现，且通过应用程序接口来配置路由和中介的规则。

Apache Camel存在安全漏洞，攻击者可利用该漏洞通过制作恶意EventFactory来暴露敏感数据。

Severity: 低

Patch Name: Apache Camel存在未明漏洞（CNVD-2024-26185）的补丁

Patch Description:

Apache Camel存在安全漏洞，攻击者可利用该漏洞通过制作恶意EventFactory来暴露敏感数据。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://camel.apache.org/security/CVE-2024-22371.html

Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-22371

Impacted products

Name
['Apache Camel <3.21.4', 'Apache Camel <3.22.1', 'Apache Camel <4.0.4', 'Apache Camel <4.1.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-22371",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-22371"
    }
  },
  "description": "Apache Camel\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u5f00\u6e90\u7684\u57fa\u4e8eEnterprise Integration Pattern(\u4f01\u4e1a\u6574\u5408\u6a21\u5f0f\uff0c\u7b80\u79f0EIP)\u7684\u96c6\u6210\u6846\u67b6\u3002\u8be5\u6846\u67b6\u63d0\u4f9b\u4f01\u4e1a\u96c6\u6210\u6a21\u5f0f\u7684Java\u5bf9\u8c61\uff08POJO\uff09\u7684\u5b9e\u73b0\uff0c\u4e14\u901a\u8fc7\u5e94\u7528\u7a0b\u5e8f\u63a5\u53e3\u6765\u914d\u7f6e\u8def\u7531\u548c\u4e2d\u4ecb\u7684\u89c4\u5219\u3002\n\nApache Camel\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u5236\u4f5c\u6076\u610fEventFactory\u6765\u66b4\u9732\u654f\u611f\u6570\u636e\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://camel.apache.org/security/CVE-2024-22371.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-26185",
  "openTime": "2024-06-06",
  "patchDescription": "Apache Camel\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u5f00\u6e90\u7684\u57fa\u4e8eEnterprise Integration Pattern(\u4f01\u4e1a\u6574\u5408\u6a21\u5f0f\uff0c\u7b80\u79f0EIP)\u7684\u96c6\u6210\u6846\u67b6\u3002\u8be5\u6846\u67b6\u63d0\u4f9b\u4f01\u4e1a\u96c6\u6210\u6a21\u5f0f\u7684Java\u5bf9\u8c61\uff08POJO\uff09\u7684\u5b9e\u73b0\uff0c\u4e14\u901a\u8fc7\u5e94\u7528\u7a0b\u5e8f\u63a5\u53e3\u6765\u914d\u7f6e\u8def\u7531\u548c\u4e2d\u4ecb\u7684\u89c4\u5219\u3002\r\n\r\nApache Camel\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u5236\u4f5c\u6076\u610fEventFactory\u6765\u66b4\u9732\u654f\u611f\u6570\u636e\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Camel\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2024-26185\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apache Camel \u003c3.21.4",
      "Apache Camel \u003c3.22.1",
      "Apache Camel \u003c4.0.4",
      "Apache Camel \u003c4.1.0"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2024-22371",
  "serverity": "\u4f4e",
  "submitTime": "2024-03-14",
  "title": "Apache Camel\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2024-26185\uff09"
}

CVE-2024-22371 (GCVE-0-2024-22371)

Vulnerability from cvelistv5

Published

2024-02-26 09:22

Modified

2024-10-31 13:03

Severity ?

2.9 (Low) - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data.

Summary

Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0. Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.

References

▼	URL	Tags
	https://camel.apache.org/security/CVE-2024-22371.html	vendor-advisory

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Camel	Version: 3.21.x ≤ 3.21.3 Version: 3.22.x ≤ 3.22.0 Version: 4.0.x ≤ 4.0.3 Version: 4.x ≤ 4.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:43:34.525Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://camel.apache.org/security/CVE-2024-22371.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22371",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-05T14:48:22.345763Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-922",
                "description": "CWE-922 Insecure Storage of Sensitive Information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-31T13:03:53.000Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Camel",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.6.0",
              "status": "unaffected",
              "version": "1.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.21.3",
              "status": "affected",
              "version": "3.21.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.22.0",
              "status": "affected",
              "version": "3.22.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.0.3",
              "status": "affected",
              "version": "4.0.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.0",
              "status": "affected",
              "version": "4.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Otavio Rodolfo Piske from the Apache Software Foundation"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.\u003cp\u003eThis issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.\n\nUsers are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Low"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data.",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-26T09:22:38.384Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://camel.apache.org/security/CVE-2024-22371.html"
        }
      ],
      "source": {
        "defect": [
          "CAMEL-20305"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Apache Camel issue on ExchangeCreatedEvent",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-22371",
    "datePublished": "2024-02-26T09:22:38.384Z",
    "dateReserved": "2024-01-09T12:04:27.624Z",
    "dateUpdated": "2024-10-31T13:03:53.000Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted