GitHub Advisoryadvisory · Maven

GHSA-2fw5-rvf2-jq56 Apache Camel's XSLT component allows remote attackers to read arbitrary files

HIGH Published 2018-10-16 Modified 2023-02-15 Official page ↗
Aliases
CVE-2014-0002
Ecosystem
Maven
Packages
org.apache.camel:camel-core
Severity
High
Reviewed
2020-06-16

Affected packages

• Maven org.apache.camel:camel-core: < 2.11.4 → fixed in 2.11.4 • Maven org.apache.camel:camel-core: >= 2.12.0, < 2.12.3 → fixed in 2.12.3

Description

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Related

Alias · CVE (1)

  • CVE-2014-0002 The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have… vulnerability

References