Loading...
Skip to main content
GeekWala

CVE-2022-45046 — Vulnerability in org.apache.camel:camel-ldap —...

CRITICAL

camel-ldap component allows LDAP Injection when using the filter option

Published December 5, 2022Updated November 8, 2023Source: osv

Summary

The camel-ldap component allows LDAP Injection when using the filter option. Users are recommended to either move to the Camel-Spring-Ldap component (which is not affected) or upgrade to 3.14.6 or 3.18.4.

Advisory Timeline

  • First published December 5, 2022 (1407 days ago).
  • Last revised November 8, 2023 — 338 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update org.apache.camel:camel-ldap to 3.14.6 or later
<!-- Update pom.xml dependency version to 3.14.6 for org.apache.camel:camel-ldap -->
Maven
Update org.apache.camel:camel-ldap to 3.18.4 or later
<!-- Update pom.xml dependency version to 3.18.4 for org.apache.camel:camel-ldap -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: maven (1).

PackageEcosystemAffectedFixed In
org.apache.camel:camel-ldap
maven
1.5.0, 1.6.0, 1.6.1, 1.6.2 (+176 more)3.14.6
org.apache.camel:camel-ldap
maven
3.15.0, 3.16.0, 3.17.0, 3.18.0 (+3 more)3.18.4

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2022-45046?
camel-ldap component allows LDAP Injection when using the filter option This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2022-45046?
CVE-2022-45046 affects org.apache.camel:camel-ldap. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-45046 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-w66j-xc7r-m2jv

Related CVEs

  • CVE-2026-40453
    CRITICAL

    Apache Camel has an incomplete fix for CVE-2025-27636

  • CVE-2026-40860
    CRITICAL

    Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage

  • CVE-2026-56140
    CRITICAL

    Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy

  • CVE-2026-40859
    HIGH

    Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

  • CVE-2026-42527
    HIGH

    Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

  • CVE-2026-43866
    HIGH

    Apache Camel JMS deserialization filter bypass

  • CVE-2026-46592
    HIGH

    Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation

  • CVE-2026-40473
    HIGH

    Camel-MINA Vulnerable to Deserialization of Untrusted Data

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies