CVE-2014-0002 Apache Camel's XSLT component allows remote attackers to read arbitrary files
HighCVSS 7.5
EPSS 27.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.camel/camel-core(Maven) | < 2.11.4 | 2.11.4 |
| org.apache.camel/camel-core(Maven) | >= 2.12.0, < 2.12.3 | 2.12.3 |
| org.apache.camel/camel-core(Maven) | = 1.0.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 1.1.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 1.2.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 1.3.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 1.4.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 1.5.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 1.6.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 1.6.1 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 1.6.2 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 1.6.3 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 1.6.4 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.0-M1 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.0-M2 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.0-M3 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.0.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.1.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.10.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.10.1 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.10.2 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.10.3 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.10.4 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.10.5 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.10.6 | No fix listed |
Show 67 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.camel/camel-core(Maven) | = 2.10.7 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.11.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.11.1 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.11.2 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.11.3 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.2.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.3.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.4.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.5.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.6.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.7.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.7.1 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.7.2 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.7.3 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.7.4 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.7.5 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.8.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.8.1 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.8.2 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.8.3 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.8.4 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.8.5 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.8.6 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.9.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.9.0-RC1 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.9.1 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.9.2 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.9.3 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.9.4 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.9.5 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.9.6 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.9.7 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.9.8 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.12.0 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.12.1 | No fix listed |
| org.apache.camel/camel-core(Maven) | = 2.12.2 | No fix listed |
| apache camel | <= 2.11.3 | No fix listed |
| apache camel | = 1.0.0 | No fix listed |
| apache camel | = 1.1.0 | No fix listed |
| apache camel | = 1.2.0 | No fix listed |
| apache camel | = 1.3.0 | No fix listed |
| apache camel | = 1.4.0 | No fix listed |
| apache camel | = 1.5.0 | No fix listed |
| apache camel | = 1.6.0 | No fix listed |
| apache camel | = 1.6.1 | No fix listed |
| apache camel | = 1.6.2 | No fix listed |
| apache camel | = 1.6.3 | No fix listed |
| apache camel | = 1.6.4 | No fix listed |
| apache camel | = 2.0.0 | No fix listed |
| apache camel | = 2.0.0-milestone1 | No fix listed |
| apache camel | = 2.0.0-milestone2 | No fix listed |
| apache camel | = 2.0.0-milestone3 | No fix listed |
| apache camel | = 2.1.0 | No fix listed |
| apache camel | = 2.10.0 | No fix listed |
| apache camel | = 2.10.1 | No fix listed |
| apache camel | = 2.10.2 | No fix listed |
| apache camel | = 2.10.3 | No fix listed |
| apache camel | = 2.10.4 | No fix listed |
| apache camel | = 2.10.5 | No fix listed |
| apache camel | = 2.10.6 | No fix listed |
| apache camel | = 2.10.7 | No fix listed |
| apache camel | = 2.11.0 | No fix listed |
| apache camel | = 2.11.1 | No fix listed |
| apache camel | = 2.11.2 | No fix listed |
| apache camel | = 2.12.0 | No fix listed |
| apache camel | = 2.12.1 | No fix listed |
| apache camel | = 2.12.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- lists.apache.org
- lists.apache.org
- camel.apache.org exploit vendor-advisory
- RHSA-2014:0371 vendor-advisory
- RHSA-2014:0372 vendor-advisory
- [camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html mailing-list
- [camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html mailing-list
- web.archive.org
- github.com patch
- github.com patch
- github.com patch
- issues.apache.org
- github.com
- github.com product
- 57125 third-party-advisory vendor-advisory
- 57716 third-party-advisory
- 57719 third-party-advisory
- 65901 vdb-entry