Setting enableCORS on a Jetty endpoint installs a CrossOriginFilter that, by default, accepts every origin and allows credentials. This flaw lets a page hosted on any third‑party domain send authenticated requests to the endpoint and read the responses, effectively leaking confidential data without the operator's knowledge. The weakness is categorized as CWE‑942, which denotes a cross‑site request forgery or cross‑domain permission issue.

Apache Camel users running Jetty component versions before 4.18.5 (including 4.0.0 to 4.18.4) and before 4.22.1 (including 4.19.0 to 4.22.0) are impacted. The affected releases are the 4.18.x Long Term Support stream and the 4.22.x Long Term Support stream, as well as all intermediate releases in those ranges.

The vulnerability receives a CVSS score of 4.3, indicating moderate impact. No EPSS score is published, so current exploit probability is uncertain, but the defect is remotely exploitable via the browser’s cross‑origin mechanism; any user can trigger it from a malicious web page. The vulnerability is not listed in the CISA KEV catalog. Attackers need only access to the target endpoint’s URL and can then craft a web page that loads resources from that origin with credentials, gaining direct read access to response data. The security implications span confidentiality breaches and potential privacy violations for data returned by the resource.