Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-2t17-p8c3-bfgv
Vulnerability ID VCID-2t17-p8c3-bfgv
Aliases CVE-2024-22371
GHSA-qpxm-689r-3849
Summary Apache Camel data exposure vulnerability Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel. This issue affects Apache Camel: from 3.0.0 through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0. Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.
Status Published
Exploitability 0.5
Weighted Severity 2.7
Risk 1.4
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-922 Insecure Storage of Sensitive Information
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-201 Insertion of Sensitive Information Into Sent Data
System Score Found at
cvssv3 2.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-22371.json
epss 0.0068 https://api.first.org/data/v1/epss?cve=CVE-2024-22371
epss 0.0068 https://api.first.org/data/v1/epss?cve=CVE-2024-22371
epss 0.00853 https://api.first.org/data/v1/epss?cve=CVE-2024-22371
epss 0.00853 https://api.first.org/data/v1/epss?cve=CVE-2024-22371
epss 0.00853 https://api.first.org/data/v1/epss?cve=CVE-2024-22371
epss 0.00853 https://api.first.org/data/v1/epss?cve=CVE-2024-22371
epss 0.00853 https://api.first.org/data/v1/epss?cve=CVE-2024-22371
epss 0.00853 https://api.first.org/data/v1/epss?cve=CVE-2024-22371
epss 0.00853 https://api.first.org/data/v1/epss?cve=CVE-2024-22371
epss 0.00853 https://api.first.org/data/v1/epss?cve=CVE-2024-22371
epss 0.00853 https://api.first.org/data/v1/epss?cve=CVE-2024-22371
epss 0.00853 https://api.first.org/data/v1/epss?cve=CVE-2024-22371
epss 0.00853 https://api.first.org/data/v1/epss?cve=CVE-2024-22371
epss 0.00853 https://api.first.org/data/v1/epss?cve=CVE-2024-22371
cvssv3.1 2.9 https://camel.apache.org/security/CVE-2024-22371.html
generic_textual LOW https://camel.apache.org/security/CVE-2024-22371.html
ssvc Track https://camel.apache.org/security/CVE-2024-22371.html
cvssv3.1_qr LOW https://github.com/advisories/GHSA-qpxm-689r-3849
cvssv3.1 2.9 https://github.com/apache/camel
generic_textual LOW https://github.com/apache/camel
cvssv3.1 2.9 https://issues.apache.org/jira/browse/CAMEL-20305
generic_textual LOW https://issues.apache.org/jira/browse/CAMEL-20305
cvssv3.1 2.9 https://nvd.nist.gov/vuln/detail/CVE-2024-22371
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2024-22371
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-22371.json
https://api.first.org/data/v1/epss?cve=CVE-2024-22371
https://camel.apache.org/security/CVE-2024-22371.html
https://github.com/apache/camel
https://issues.apache.org/jira/browse/CAMEL-20305
https://nvd.nist.gov/vuln/detail/CVE-2024-22371
2266024 https://bugzilla.redhat.com/show_bug.cgi?id=2266024
GHSA-qpxm-689r-3849 https://github.com/advisories/GHSA-qpxm-689r-3849
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-22371.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://camel.apache.org/security/CVE-2024-22371.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-05T14:48:22Z/ Found at https://camel.apache.org/security/CVE-2024-22371.html
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/apache/camel
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://issues.apache.org/jira/browse/CAMEL-20305
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-22371
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.71536
EPSS Score 0.0068
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:50:22.022905+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-qpxm-689r-3849/GHSA-qpxm-689r-3849.json 38.0.0