7.8

CVE-2024-22369

EPSS 3.56%
Published 20.02.2024 15:15:10
Last modified 02.04.2025 20:17:04
Source security@apache.org
Teams watchlist Login
Open Login

Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0.

Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1

Affected products Warnungen 0 Metrics 2 CWE 1 References 4

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD

This information is available to logged-in users.

Data is provided by the National Vulnerability Database (NVD)

Apache ≫ Camel Version >= 3.0.0 < 3.21.4

Apache ≫ Camel Version >= 4.0.0 < 4.0.4

Apache ≫ Camel Version >= 4.1.0 < 4.4.0

Apache ≫ Camel Version3.22.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	3.56%	0.873

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://lists.apache.org/thread/3dko781dy2gy5l3fs48p56fgp429yb0f

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2024-22369

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-22369

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-22369

EUVD