CVE-2025-30177

{"id": "CVE-2025-30177", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2025-04-01T12:15:15.747", "references": [{"url": "https://camel.apache.org/security/CVE-2025-27636.html", "tags": ["Not Applicable"], "source": "security@apache.org"}, {"url": "https://camel.apache.org/security/CVE-2025-29891.html", "tags": ["Not Applicable"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/dj79zdgw01j337lr9gvyy4sv8xfyw8py", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-164"}]}], "descriptions": [{"lang": "en", "value": "Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions.\n\nThis issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6.\n\nUsers are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS.\n\nCamel undertow component is vulnerable to Camel message header injection, in particular the custom header filter strategy used by the component only filter the \"out\" direction, while it doesn't filter the \"in\" direction.\n\n\nThis allows an attacker to include Camel specific headers that for some Camel components can alter the behaviour such as the camel-bean component, or the camel-exec component."}, {"lang": "es", "value": "Vulnerabilidad de omisi\u00f3n/inyecci\u00f3n en Apache Camel en el componente Camel-Undertow bajo ciertas condiciones. Este problema afecta a Apache Camel: de la versi\u00f3n 4.10.0 a la 4.10.3, y de la versi\u00f3n 4.8.0 a la 4.8.6. Se recomienda a los usuarios actualizar a la versi\u00f3n 4.10.3 para la versi\u00f3n 4.10.x LTS y a la 4.8.6 para la versi\u00f3n 4.8.x LTS. El componente Camel Undertow es vulnerable a la inyecci\u00f3n de encabezados de mensajes de Camel; en particular, la estrategia de filtrado de encabezados personalizada que utiliza el componente solo filtra la direcci\u00f3n de salida, pero no la de entrada. Esto permite a un atacante incluir encabezados espec\u00edficos de Camel que, en algunos componentes de Camel, pueden alterar el comportamiento, como los componentes camel-bean o camel-exec."}], "lastModified": "2025-04-15T13:00:12.587", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9FD8755-3AFF-46F8-A830-FD0BF04B5DB8", "versionEndExcluding": "4.8.6", "versionStartIncluding": "4.8.0"}, {"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "874BB2C0-D562-4EC9-A839-BAEED574AD41", "versionEndExcluding": "4.10.3", "versionStartIncluding": "4.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}