org.apache.camel:camel-platform-http-vertx@4.14.2

latest version

4.23.0

latest non vulnerable version

4.23.0

first published

6 years ago

latest version published

12 days ago

licenses detected

Apache-2.0
[3.2.0,)

package registry

View on Maven Central Repository

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.apache.camel:camel-platform-http-vertx package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
H Permissive Cross-domain Policy with Untrusted Domains Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the `createCorsHandler()` method in the Platform HTTP Vertx component. When CORS is enabled and `camel.server.cors.origins` is unset, an attacker can make a page on any origin send credentialed cross-origin requests and read the responses, exposing data available to the user's credentials. Notes The browser-request step requires a user to visit the attacker-controlled page while authenticated to the Camel endpoint; the attack reads data available to that user’s credentials. Workarounds Set `camel.server.cors.origins` to an explicit list of trusted origins instead of leaving it unset. This prevents the handler from reflecting arbitrary origins, limiting credentialed cross-origin access to the origins you list. How to fix Permissive Cross-domain Policy with Untrusted Domains? Upgrade `org.apache.camel:camel-platform-http-vertx` to version 4.18.5, 4.22.1 or higher.	[4.0.0,4.18.5)[4.19.0,4.22.1)

Permissive Cross-domain Policy with Untrusted Domains

Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the createCorsHandler() method in the Platform HTTP Vertx component. When CORS is enabled and camel.server.cors.origins is unset, an attacker can make a page on any origin send credentialed cross-origin requests and read the responses, exposing data available to the user's credentials.

Notes

The browser-request step requires a user to visit the attacker-controlled page while authenticated to the Camel endpoint; the attack reads data available to that user’s credentials.

Workarounds

Set camel.server.cors.origins to an explicit list of trusted origins instead of leaving it unset. This prevents the handler from reflecting arbitrary origins, limiting credentialed cross-origin access to the origins you list.

How to fix Permissive Cross-domain Policy with Untrusted Domains?

Upgrade org.apache.camel:camel-platform-http-vertx to version 4.18.5, 4.22.1 or higher.

[4.0.0,4.18.5)[4.19.0,4.22.1)

Go back to all versions of this package