Homepage About Snyk

XML External Entity (XXE) Injection Affecting org.apache.camel:camel-core package, versions (,2.13.3] [2.14.0,2.14.1]

0.0
medium

  • Attack Complexity

    Low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

  • snyk-id

    SNYK-JAVA-ORGAPACHECAMEL-30006

  • published

    17 Mar 2015

  • disclosed

    17 Mar 2015

  • credit

    Unknown

Report a new vulnerability Found a mistake?

Introduced: 17 Mar 2015

CVE-2015-0264 Open this link in a new tab
CWE-611 Open this link in a new tab

Overview

org.apache.camel:camel-core is a versatile open-source integration framework based on known Enterprise Integration Patterns.

Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.