CVE-2015-0263

Description

XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.

Risk Information

Base Score

4.2

MODERATE

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C

EPSS Score

Exploitation Probability

3.62

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2015-0264,CVE-2015-0263 are fixed in Apache-camel-core 2.13.4	Windows
Vulnerabilities CVE-2015-0264,CVE-2015-0263 are fixed in Apache-camel-core 2.14.2	Windows
Vulnerabilities CVE-2015-0264,CVE-2015-0263 are fixed in Apache-camel-core for Linux 2.13.4	Linux
Vulnerabilities CVE-2015-0264,CVE-2015-0263 are fixed in Apache-camel-core for Linux 2.14.2	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234