Homepage
About Snyk

XML External Entity (XXE) Injection Affecting org.apache.camel:camel-core package, versions (,2.13.3] [2.14.0,2.14.1]

0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.95% (83rd percentile)
Expand this section
NVD
5.3 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGAPACHECAMEL-30006
  • published 17 Mar 2015
  • disclosed 17 Mar 2015
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 17 Mar 2015

CVE-2015-0264 Open this link in a new tab
CWE-611 Open this link in a new tab

Overview

org.apache.camel:camel-core is a versatile open-source integration framework based on known Enterprise Integration Patterns.

Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.