Vulnerability	Vulnerable Version
M Improperly Controlled Modification of Dynamically-Determined Object Attributes Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the `NatsConsumer` process. An attacker can manipulate downstream producer behavior by injecting arbitrary control headers into messages published to the NATS subject. This can result in actions such as redirecting HTTP producers, changing file names, or overriding queries by supplying specially crafted headers. The injected headers persist across internal direct, seda, and vm hops. This is only exploitable if the NATS server is configured without authentication and NATS 2.2 or later is used. How to fix Improperly Controlled Modification of Dynamically-Determined Object Attributes? Upgrade `org.apache.camel:camel-nats` to version 4.14.8, 4.18.3, 4.21.0 or higher.	[4.0.0,4.14.8)[4.15.0,4.18.3)[4.19.0,4.21.0)

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the NatsConsumer process. An attacker can manipulate downstream producer behavior by injecting arbitrary control headers into messages published to the NATS subject. This can result in actions such as redirecting HTTP producers, changing file names, or overriding queries by supplying specially crafted headers. The injected headers persist across internal direct, seda, and vm hops. This is only exploitable if the NATS server is configured without authentication and NATS 2.2 or later is used.

How to fix Improperly Controlled Modification of Dynamically-Determined Object Attributes?

Upgrade org.apache.camel:camel-nats to version 4.14.8, 4.18.3, 4.21.0 or higher.

[4.0.0,4.14.8)[4.15.0,4.18.3)[4.19.0,4.21.0)

Go back to all versions of this package