Apache Camel's XSLT component allows remote attackers to read arbitrary files
High severity
GitHub Reviewed
Published
Oct 16, 2018
to the GitHub Advisory Database
•
Updated Dec 19, 2023
Package
Affected versions
< 2.11.4
>= 2.12.0, < 2.12.3
Patched versions
2.11.4
2.12.3
Description
Published by the National Vulnerability Database
Mar 21, 2014
Published to the GitHub Advisory Database
Oct 16, 2018
Reviewed
Jun 16, 2020
Last updated
Dec 19, 2023
Credits
-
sunSUNQ Analyst
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
References