CVE-2014-0002 – org.apache.camel:camel-core

Package

Manager: maven
Name: org.apache.camel:camel-core
Vulnerable Version: >=0 <2.11.4 || >=2.12.0 <2.12.3

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

EPSS: 0.28739 pctl0.96377

Details

Apache Camel's XSLT component allows remote attackers to read arbitrary files The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Metadata

Created: 2018-10-16T23:13:26Z
Modified: 2023-02-15T22:19:10Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-2fw5-rvf2-jq56/GHSA-2fw5-rvf2-jq56.json
CWE IDs: []
Alternative ID: GHSA-2fw5-rvf2-jq56
Finding: F083
Auto approve: 1