Security Resilience

CVE-2024-22371

Apache Camel 3.0.0 – 3.21.4

Published
26 February 2024
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 2.9
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0069 52th percentile
Risk Priority 29 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-22371 is a low-severity Insecure Storage of Sensitive Information (CWE-922) vulnerability in Apache Camel. Its CVSS base score is 2.9 (Low).

Operationally, ranked in the top 48% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from…

more

4.X through 4.3.0. Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.

CWE(s)
CWE-922

Related Threats

CVEs Like This One

CVE-2026-49097Same product: Apache Camel
CVE-2026-42527Same product: Apache Camel
CVE-2026-55994Same product: Apache Camel
CVE-2026-40858Same product: Apache Camel
CVE-2026-23552Same product: Apache Camel
CVE-2026-27172Same product: Apache Camel
CVE-2026-40048Same product: Apache Camel
CVE-2026-46726Same product: Apache Camel
CVE-2026-47323Same product: Apache Camel
CVE-2026-71300Same product: Apache Camel

Affected Assets

apache
camel
3.22.0 · 3.0.0 — 3.21.4 · 4.0.0 — 4.0.4 · 4.1.0 — 4.4.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Enforces approved authorizations for logical access to stored information, directly stopping unauthorized read/write.

SC-28 Protection of Information at Rest good match

Requires protection of confidentiality/integrity for information at rest, directly addressing insecure storage.

AC-6 Least Privilege good match

Limits privileges so only authorized accesses to sensitive stored data are permitted.

AC-16 Security and Privacy Attributes partial match

Associates security attributes with information to support proper access decisions on storage.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.7.14 Secure disposal or re-use of equipment none match
blocks

A.7.14 addresses end-of-life physical destruction, sanitization or label removal on equipment/media already containing data; it does not stop the product from storing sensitive information without limiting unauthorized read/write access in the first place.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-922, a class-level weakness. Rules are authored against its narrower children: CWE-312.

References