PT-2014-3426 · Apache · Apache Camel

Publicado 2014-03-20 · Atualizado 2023-02-13 · CVE-2014-0002

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Camel versions prior to 2.11.4 Apache Camel versions 2.12.x prior to 2.12.3

Description The issue allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Recommendations For Apache Camel versions prior to 2.11.4, update to version 2.11.4 or later. For Apache Camel versions 2.12.x prior to 2.12.3, update to version 2.12.3 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-0002

GHSA-2FW5-RVF2-JQ56

Produtos afetados

Apache Camel

Referências · 19

• 🔥 http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc · Exploit
• https://github.com/apache/camel · Nota
• https://github.com/apache/camel/commit/341d4e6cca71c53c90962d1c3d45fc9e05cc50c6 · Nota
• https://github.com/apache/camel/commit/54b65c1d30848835f26bd138c0ba407bc1e560d · Nota
• https://github.com/apache/camel/commit/2ec54fa0c13ae65bdcccff764af081a79fcc05f · Nota
• https://osv.dev/vulnerability/GHSA-2fw5-rvf2-jq56 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2014-0372.html · Aviso do Fabricante
• https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E · Nota
• https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E · Nota
• http://rhn.redhat.com/errata/RHSA-2014-0371.html · Aviso do Fabricante
• https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E · Nota
• http://secunia.com/advisories/57716 · Nota
• http://securityfocus.com/bid/65901 · Nota
• http://secunia.com/advisories/57125 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-0002 · Nota de Segurança