Tóm tắt nhanh
- CVE-2025-30177 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng org.apache.camel:camel-undertow, camel (apache).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.3%, cao hơn 70.3% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 4.10.3, 4.8.6 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| org.apache.camel:camel-undertow Maven | ≥ 4.10.0, < 4.10.3≥ 4.8.0, < 4.8.6
| 4.10.34.8.6
|
| camel | ≥ 4.10.0, < 4.10.3≥ 4.8.0, < 4.8.6
| 4.10.34.8.6
|
Mô tả
Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions.
This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6.
Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS.
Camel undertow component is vulnerable to Camel message header injection, in particular the custom header filter strategy used by the component only filter the "out" direction, while it doesn't filter the "in" direction.
This allows an attacker to include Camel specific headers that for some Camel components can alter the behaviour such as the camel-bean component, or the camel-exec component.
Mô tả của NVD
Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions.
This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6.
Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS.
Camel undertow component is vulnerable to Camel message header injection, in particular the custom header filter strategy used by the component only filter the "out" direction, while it doesn't filter the "in" direction.
This allows an attacker to include Camel specific headers that for some Camel components can alter the behaviour such as the camel-bean component, or the camel-exec component.
Lỗ hổng khác của org.apache.camel:camel-undertow
Xem tất cả →Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí