Apache Camel vulnerable to XML external entity injection (XXE)

🗓️ 22 May 2019 05:37:33Reported by Japan Vulnerability NotesType

Apache Camel is vulnerable to XML external entity injection; update to the latest version to remove the vulnerable library and prevent file reads.

Reporter	Title	Published	Views	Family All 22
IBM Security Bulletins	Security Bulletin: IBM Jazz for Service Management is vulnerable due to issues in JDOM, Apache Log4j 1.x, Apache ActiveMQ and Apache Camel	24 Jun 202511:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Netcool Impact is affected by an Apache Camel vulnerability (CVE-2019-0188)	20 Dec 201908:47	–	ibm
IBM Security Bulletins	Security Bulletin:IBM Resilient SOAR is Using Components with Known Vulnerabilities - Apache Camel ( CVE-2019-0188, CVE-2020-11972, CVE-2020-11973)	1 Oct 202012:30	–	ibm
BDU FSTEC	The vulnerability of the JSON-lib library and the camel-xmljson component of the Java framework Apache Camel, which allows attackers to execute an XXE attack	3 Dec 201900:00	–	bdu_fstec
Circl	CVE-2019-0188	9 Jan 202415:17	–	circl
CNVD	Apache Camel XML External Entity Injection Vulnerability	22 May 201900:00	–	cnvd
CVE	CVE-2019-0188	28 May 201918:10	–	cve
Cvelist	CVE-2019-0188	28 May 201918:10	–	cvelist
EUVD	EUVD-2019-0466	7 Oct 202500:30	–	euvd
Github Security Blog	XML External Entity injection in Apache Camel	29 May 201918:15	–	github

Source	Link
camel	www.camel.apache.org/
github	www.github.com/apache/camel/releases/tag/camel-2.24.0
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
jvn	www.jvn.jp/en/jp/JVN71498764/index.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-0188
ipa	www.ipa.go.jp/en/security/vulnerabilities/cwe.html

30 Sep 2019 09:14Current

7.2High risk

Vulners AI Score7.2

CVSS 25

CVSS 35.8

CVSS 3.17.5

EPSS0.08463