Apache Camel XML External Entity vulnerability

MEDIUM 5.0CVE-2015-0263 · GHSA-3hrc-f439-727g · Published 03/06/2015 · updated 17/06/2026

In short

CVE-2015-0263 is a MEDIUM (CVSS 5.0) vulnerability affecting org.apache.camel:camel-core, camel (apache).
Chance of exploitation in the next 30 days (EPSS): 7.5%, higher than 94.5% of all vulnerabilities.
Fix: update to 2.14.2, 2.13.4 or later.

Package	Affected versions	Patched versions
org.apache.camel:camel-core Maven	`≥ 2.14.0, < 2.14.2< 2.13.4`	`2.14.22.13.4`
camel apache	`= 2.14.0= 2.14.1≤ 2.13.3`	No fix yet

Description

XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2015-0263 · ADVISORY
apache/camel commit 06db9e0 · WEB
apache/camel commit 367d53e · WEB
apache/camel commit 7d19340 · WEB
camel.apache.org/security-advisories.data/CVE-2015-0263.txt.asc · WEB
git-wip-us.apache.org/repos/asf · WEB
GitHub Advisory GHSA-3hrc-f439-727g · ADVISORY
apache/camel · PACKAGE
issues.apache.org/jira/browse/CAMEL-8312 · WEB
lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E · WEB

More vulnerabilities in org.apache.camel:camel-core

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.camel:camel-core

Maven

≥ 2.14.0, < 2.14.2< 2.13.4

2.14.22.13.4

camel

apache

= 2.14.0= 2.14.1≤ 2.13.3

No fix yet

Description

NVD description

More vulnerabilities in org.apache.camel:camel-core

See all →