CVE-2025-30177
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
01/04/2025
Last modified:
15/04/2025
Description
Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions.<br />
<br />
This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6.<br />
<br />
Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS.<br />
<br />
Camel undertow component is vulnerable to Camel message header injection, in particular the custom header filter strategy used by the component only filter the "out" direction, while it doesn&#39;t filter the "in" direction.<br />
<br />
<br />
This allows an attacker to include Camel specific headers that for some Camel components can alter the behaviour such as the camel-bean component, or the camel-exec component.
Impact
Base Score 3.x
6.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* | 4.8.0 (including) | 4.8.6 (excluding) |
| cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* | 4.10.0 (including) | 4.10.3 (excluding) |
To consult the complete list of CPE names with products and versions, see this page