U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • CPE Product Version: cpe:/a:apache:camel:2.17.0
There are 7 matching records.
Displaying matches 1 through 7.
Vuln ID Summary CVSS Severity
CVE-2019-0188

Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.

Published: May 28, 2019; 3:29:02 PM -0400 		V3.1: 7.5 HIGH
 V2.0: 5.0 MEDIUM
CVE-2019-0194

Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.19 and earlier) versions may be also affected.

Published: April 30, 2019; 6:29:00 PM -0400 		V3.0: 7.5 HIGH
 V2.0: 5.0 MEDIUM
CVE-2017-12634

The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.

Published: November 15, 2017; 10:29:00 AM -0500 		V3.0: 9.8 CRITICAL
 V2.0: 7.5 HIGH
CVE-2017-12633

The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.

Published: November 15, 2017; 10:29:00 AM -0500 		V3.0: 9.8 CRITICAL
 V2.0: 7.5 HIGH
CVE-2016-8749

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.

Published: March 28, 2017; 2:59:00 PM -0400 		V3.0: 9.8 CRITICAL
 V2.0: 7.5 HIGH
CVE-2017-5643

Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.

Published: March 16, 2017; 11:59:00 AM -0400 		V3.0: 7.4 HIGH
 V2.0: 5.8 MEDIUM
CVE-2017-3159

Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.

Published: March 07, 2017; 10:59:00 AM -0500 		V3.0: 9.8 CRITICAL
 V2.0: 7.5 HIGH