JVN#71498764: Apache Camel vulnerable to XML external entity injection (XXE)

2019-05-2200:00:00

Japan Vulnerability Notes

jvn.jp

135

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.004 Low

EPSS

Percentile

74.7%

JSON

Apache Camel provided by The Apache Software Foundation contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library.

Impact

By processing a specially crafted request, an arbitrary file on the server may be read.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.
According to the developer, the outdated vulnerable JSON-lib library was removed from the latest version.