CVE-2025-30177
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
01/04/2025
Last modified:
01/04/2025
Description
Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions.<br />
<br />
This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6.<br />
<br />
Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS.<br />
<br />
Camel undertow component is vulnerable to Camel message header injection, in particular the custom header filter strategy used by the component only filter the "out" direction, while it doesn&#39;t filter the "in" direction.<br />
<br />
<br />
This allows an attacker to include Camel specific headers that for some Camel components can alter the behaviour such as the camel-bean component, or the camel-exec component.
Impact
Base Score 3.x
6.50
Severity 3.x
MEDIUM