SB2024061873 - Multiple vulnerabilities in Red Hat Integration Camel Extensions for Quarkus 3.2.12

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024061873

SB2024061873 - Multiple vulnerabilities in Red Hat Integration Camel Extensions for Quarkus 3.2.12

Published: June 18, 2024

Security Bulletin ID SB2024061873
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2024-28752)

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in Aegis DataBinding. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.


2) Cleartext storage of sensitive information (CVE-ID: CVE-2024-2700)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to cleartext storage of sensitive information in an environment variable. A local user can exploit this vulnerability to obtain local configuration properties information, and use this information to launch further attacks against the affected system.


Remediation

Install update from vendor's website.

References