{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2013-01-14T00:00:00", "descriptions": [{"lang": "en", "value": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-05-24T10:06:03", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "57125", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/57125"}, {"name": "RHSA-2014:0371", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2014-0371.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"}, {"name": "57719", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/57719"}, {"name": "65901", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/65901"}, {"name": "57716", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/57716"}, {"name": "RHSA-2014:0372", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2014-0372.html"}, {"name": "[camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E"}, {"name": "[camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T08:58:26.467Z"}, "title": "CVE Program Container", "references": [{"name": "57125", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/57125"}, {"name": "RHSA-2014:0371", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2014-0371.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"}, {"name": "57719", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/57719"}, {"name": "65901", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/65901"}, {"name": "57716", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/57716"}, {"name": "RHSA-2014:0372", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2014-0372.html"}, {"name": "[camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E"}, {"name": "[camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2014-0002", "datePublished": "2014-03-20T19:00:00", "dateReserved": "2013-12-03T00:00:00", "dateUpdated": "2024-08-06T08:58:26.467Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*", "matchCriteriaId": "23ED67A5-FBB0-4151-A7C4-D7F9A82D9753", "versionEndIncluding": "2.11.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:1.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "0B06E9C0-DB2D-41D6-98C4-93D973929523", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:1.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "A1BC313E-5651-4FBB-B9E6-E66DBA0139D5", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:1.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "83727178-A7C0-4C88-A148-E522B25A8300", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:1.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "139F899A-6652-42C2-8729-F28C63B60DBA", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:1.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "1D65D943-3954-4C65-BCFE-993ABE20136B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:1.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "2ECABA1F-7D64-4272-AA2E-801C9C5CFE67", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:1.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "C03AED3D-FA8B-4730-B9DA-CFFCEF29A891", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:1.6.1:*:*:*:*:*:*:*", "matchCriteriaId": "C3D7D5F8-89C1-4CFD-8959-E50F0AF50DD0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:1.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "C1E1D4FA-C1D6-44E9-9326-DDFD16DE9ECF", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:1.6.3:*:*:*:*:*:*:*", "matchCriteriaId": "B8735662-1424-4F93-B3A3-8CB1D42F953F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:1.6.4:*:*:*:*:*:*:*", "matchCriteriaId": "506DFDFF-1712-4B4A-814C-C8CAFB7B2EF9", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:2.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "F4EA86F9-21F1-4FB1-9412-A0BC76190C24", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:2.0.0:milestone1:*:*:*:*:*:*", "matchCriteriaId": "BEFC3427-C311-4DC3-BFF7-0EE28706F729", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:2.0.0:milestone2:*:*:*:*:*:*", "matchCriteriaId": "0C4B2BB5-1535-45A3-9FB1-0B4E6D93234B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:2.0.0:milestone3:*:*:*:*:*:*", "matchCriteriaId": "5BD846E7-8B3D-42D9-AA9C-26F2F9ACCE1D", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:2.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "735DED49-ECF3-4DFE-8BF6-D47A9BA76AC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:2.10.0:*:*:*:*:*:*:*", "matchCriteriaId": "8DB96EF4-A413-4632-9D5E-8A22483E4329", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:2.10.1:*:*:*:*:*:*:*", "matchCriteriaId": "D26D7344-D86B-4BD8-97A5-F33DDCE825D4", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:2.10.2:*:*:*:*:*:*:*", "matchCriteriaId": "E8C16CB0-F061-49FA-81FF-4698E0AB6C75", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:2.10.3:*:*:*:*:*:*:*", "matchCriteriaId": "753E5480-95BE-47D5-A020-0A7B95B41A4C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:2.10.4:*:*:*:*:*:*:*", "matchCriteriaId": "02D4E217-4934-40FF-B797-2697625C4A69", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:2.10.5:*:*:*:*:*:*:*", "matchCriteriaId": "7E717996-F17E-4D82-8C18-D8590ECC8AB6", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:2.10.6:*:*:*:*:*:*:*", "matchCriteriaId": "43EC45F1-F990-4D58-90D7-86E7FE57B116", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:2.10.7:*:*:*:*:*:*:*", "matchCriteriaId": "B1D65BD5-BCCA-4C69-A9A4-E322AEBEE6F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:2.11.0:*:*:*:*:*:*:*", "matchCriteriaId": "6392BFDC-B18A-435D-A296-36CCF0AF6CF2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:2.11.1:*:*:*:*:*:*:*", "matchCriteriaId": "86CF9343-8A2C-40AB-88EC-266CB971A7D2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:2.11.2:*:*:*:*:*:*:*", "matchCriteriaId": "E6386086-1DDB-4FE9-A6A3-10B3071B1A48", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:camel:2.12.0:*:*:*:*:*:*:*", "matchCriteriaId": "D8DD9514-FCDD-4BFE-A1FD-1A44E07671FA", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:2.12.1:*:*:*:*:*:*:*", "matchCriteriaId": "8899BFF7-4077-46D4-BC20-B8FC31D76BA8", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:camel:2.12.2:*:*:*:*:*:*:*", "matchCriteriaId": "9C90E281-33F1-4010-A5A4-CB551C2B59C6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."}, {"lang": "es", "value": "El componente XSLT en Apache Camel anterior a 2.11.4 y 2.12.x anterior a 2.12.3 permite a atacantes remotos leer archivos arbitrarios y posiblemente tener otro impacto no especificado a trav\u00e9s de un documento XML que contiene una declaraci\u00f3n de entidad externa en conjunci\u00f3n con una referencia de entidad, relacionado con un problema de XML External Entity (XXE)."}], "id": "CVE-2014-0002", "lastModified": "2024-11-21T02:01:08.990", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-03-21T04:38:59.027", "references": [{"source": "secalert@redhat.com", "tags": ["Exploit", "Vendor Advisory"], "url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"}, {"source": "secalert@redhat.com", "url": "http://rhn.redhat.com/errata/RHSA-2014-0371.html"}, {"source": "secalert@redhat.com", "url": "http://rhn.redhat.com/errata/RHSA-2014-0372.html"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/57125"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/57716"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/57719"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/65901"}, {"source": "secalert@redhat.com", "url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E"}, {"source": "secalert@redhat.com", "url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2014-0371.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2014-0372.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/57125"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/57716"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/57719"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/65901"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "This issue was discovered by David Jorm (Red Hat Security Response Team).", "affected_release": [{"advisory": "RHSA-2014:0452", "cpe": "cpe:/a:redhat:fuse_esb_enterprise:7.1.0", "product_name": "Fuse ESB Enterprise 7.1.0", "release_date": "2014-04-30T00:00:00Z"}, {"advisory": "RHSA-2014:0452", "cpe": "cpe:/a:redhat:fuse_management_console:7.1.0", "product_name": "Fuse Management Console 7.1.0", "release_date": "2014-04-30T00:00:00Z"}, {"advisory": "RHSA-2014:0452", "cpe": "cpe:/a:redhat:fuse_mq_enterprise:7.1.0", "product_name": "Fuse MQ Enterprise 7.1.0", "release_date": "2014-04-30T00:00:00Z"}, {"advisory": "RHSA-2014:0323", "cpe": "cpe:/a:redhat:jboss_amq:6.0.0", "product_name": "Red Hat JBoss A-MQ 6.0", "release_date": "2014-03-24T00:00:00Z"}, {"advisory": "RHSA-2014:0371", "cpe": "cpe:/a:redhat:jboss_bpms:6.0", "package": "Camel", "product_name": "Red Hat JBoss BPMS 6.0", "release_date": "2014-04-03T00:00:00Z"}, {"advisory": "RHSA-2014:0372", "cpe": "cpe:/a:redhat:jboss_brms:6.0", "package": "Camel", "product_name": "Red Hat JBoss BRMS 6.0", "release_date": "2014-04-03T00:00:00Z"}, {"advisory": "RHSA-2014:0323", "cpe": "cpe:/a:redhat:jboss_fuse:6.0.0", "product_name": "Red Hat JBoss Fuse 6.0", "release_date": "2014-03-24T00:00:00Z"}, {"advisory": "RHSA-2014:0459", "cpe": "cpe:/a:redhat:jboss_fuse_service_works:6.0", "package": "Camel", "product_name": "Red Hat JBoss Fuse Service Works 6.0", "release_date": "2014-04-30T00:00:00Z"}], "bugzilla": {"description": "Camel: XML eXternal Entity (XXE) flaw in XSLT component", "id": "1049675", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"}, "csaw": false, "cvss": {"cvss_base_score": "5.0", "cvss_scoring_vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "status": "verified"}, "cwe": "CWE-611", "details": ["The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."], "name": "CVE-2014-0002", "package_state": [{"cpe": "cpe:/a:redhat:openshift:1", "fix_state": "Will not fix", "package_name": "camel", "product_name": "OpenShift Enterprise 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Affected", "package_name": "amq-6.0", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Affected", "package_name": "fuse-6.0", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Affected", "package_name": "fuse-esb-7.1", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Affected", "package_name": "fuse-mq-7.1", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:openshift:2", "fix_state": "Will not fix", "package_name": "camel", "product_name": "Red Hat OpenShift Enterprise 2"}], "public_date": "2014-02-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2014-0002\nhttps://nvd.nist.gov/vuln/detail/CVE-2014-0002\nhttp://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"], "threat_severity": "Moderate"}