title: Apache Camel issue on ExchangeCreatedEvent
description: Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.
Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.
problem types: Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data.
affected:
{
defaultStatus: unaffected
product: Apache Camel
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 1.6.0, status: unaffected, version: 1.x, versionType: semver
lessThanOrEqual: 3.21.3, status: affected, version: 3.21.x, versionType: semver
lessThanOrEqual: 3.22.0, status: affected, version: 3.22.x, versionType: semver
lessThanOrEqual: 4.0.3, status: affected, version: 4.0.x, versionType: semver
lessThanOrEqual: 4.3.0, status: affected, version: 4.x, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.9
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: Low