What is CVE-2024-22369?

CVE-2024-22369 is a high-severity vulnerability in Apache Camel, classified under Deserialization of Untrusted Data. CVSS score: 7.8/10. Published 2024-02-20.

How severe is CVE-2024-22369?

High severity. CVSS v3 base score is 7.8 out of 10.

Is CVE-2024-22369 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Deserialization in Apache Camel

CVE-2024-22369

Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0. Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1

Vulnerability class: Insecure Deserialization

EPSS: 0.007 (50.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Apache Camel — versions 3.22.0
Apache Software Foundation Camel — versions 3.0.0, 3.22.0, 4.0.0

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

Public proof-of-concept exploits

References

security@apache.org (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2024-22369?: CVE-2024-22369 is a high-severity vulnerability in Apache Camel, classified under Deserialization of Untrusted Data. CVSS score: 7.8/10. Published 2024-02-20.
How severe is CVE-2024-22369?: High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2024-22369 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.