Homepage

org.apache.camel:camel-platform-http@4.0.2

  • latest version

    4.23.0

  • latest non vulnerable version

    4.23.0

  • first published

    6 years ago

  • latest version published

    12 days ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.apache.camel:camel-platform-http package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Insufficient Granularity of Access Control

    Affected versions of this package are vulnerable to Insufficient Granularity of Access Control via the isHttpProxy() function in the Platform HTTP component. When a deployment exposes a route whose configured path begins with proxy (such as proxyStats), the endpoint acts as a catch-all forwarding proxy even though the route author did not intend it. An attacker can send requests to that endpoint with a chosen Host header to make Camel forward traffic to that destination, potentially exposing services reachable by the Camel application.

    Workarounds

    • Rename any endpoint path that begins with proxy but is not intended to be a proxy; this prevents it from being treated as a catch-all forwarding proxy.

    How to fix Insufficient Granularity of Access Control?

    Upgrade org.apache.camel:camel-platform-http to version 4.18.5, 4.22.1 or higher.

    [4.0.0,4.18.5)[4.19.0,4.22.1)
    Go back to all versions of this package