PT-2014-3426 · Apache · Apache Camel

Published 2014-03-20 · Updated 2023-02-13 · CVE-2014-0002

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Camel versions prior to 2.11.4 Apache Camel versions 2.12.x prior to 2.12.3

Description The issue allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Recommendations For Apache Camel versions prior to 2.11.4, update to version 2.11.4 or later. For Apache Camel versions 2.12.x prior to 2.12.3, update to version 2.12.3 or later.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-0002

GHSA-2FW5-RVF2-JQ56

Affected Products

Apache Camel

References · 19

• 🔥 http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc · Exploit
• https://osv.dev/vulnerability/GHSA-2fw5-rvf2-jq56 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0372.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0371.html · Vendor Advisory
• http://secunia.com/advisories/57125 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0002 · Security Note
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/commit/341d4e6cca71c53c90962d1c3d45fc9e05cc50c6 · Note
• https://github.com/apache/camel/commit/54b65c1d30848835f26bd138c0ba407bc1e560d · Note
• https://github.com/apache/camel/commit/2ec54fa0c13ae65bdcccff764af081a79fcc05f · Note
• https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E · Note
• https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E · Note
• https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E · Note
• http://secunia.com/advisories/57716 · Note
• http://securityfocus.com/bid/65901 · Note