Apache Camel's XSLT component allows remote attackers to read arbitrary files

published 2014-03-20 12 y ago modified 2026-06-17 4 mo ago also GHSA-2fw5-rvf2-jq56 , EUVD-2018-0475

cvss: 7.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 27.4%; EPSS 27.4% chance of exploitation in 30 days, percentile 98%
public exploits: 0; none known

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Patch / fix

fixed in 1 links 3

maven org.apache.camel:camel-core 2.11.4, 2.12.3

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-0002 updated 2026-08-04 cvss 5.0

Camel: XML eXternal Entity (XXE) flaw in XSLT component

Red Hat OpenShift Enterprise 1 camel Red Hat OpenShift Enterprise 2 camel
affected: no fix planned “Will not fix”
Red Hat Fuse ESB Enterprise 7.1.0 Red Hat Fuse Management Console 7.1.0 Red Hat Fuse MQ Enterprise 7.1.0
fixed: vendor fix RHSA-2014:0452
Red Hat JBoss A-MQ 6.0
fixed: vendor fix RHSA-2014:0323
Red Hat JBoss BPMS 6.0
fixed: vendor fix RHSA-2014:0371
Red Hat JBoss BRMS 6.0
fixed: vendor fix RHSA-2014:0372
Red Hat JBoss Fuse 6.0
fixed: vendor fix RHSA-2014:0323
Red Hat JBoss Fuse Service Works 6.0
fixed: vendor fix RHSA-2014:0459

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

27.39% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

camel.apache.org http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.camel:camel-core	<2.11.4 >=2.12.0, <2.12.3	2.11.4 2.12.3

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls

References

github.com /apache/camel/commit/2ec54fa0c13ae65bdcccff764af081a79fcc05f
web
github.com /apache/camel/commit/341d4e6cca71c53c90962d1c3d45fc9e05cc50c6
web
github.com /apache/camel/commit/54b65c1d30848835f26bd138c0ba407bc1e560d
web
camel.apache.org /security-advisories.data/CVE-2014-0002.txt.asc
web, exploit, vendor-advisory
rhn.redhat.com /errata/RHSA-2014-0371.html
vendor-advisory, web
rhn.redhat.com /errata/RHSA-2014-0372.html
vendor-advisory, web
secunia.com /advisories/57125
third-party-advisory, vendor-advisory
secunia.com /advisories/57719
third-party-advisory
securityfocus.com /bid/65901
vdb-entry
secunia.com /advisories/57716
third-party-advisory
lists.apache.org /thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E
mailing-list, web
lists.apache.org /thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E
mailing-list, web
nvd.nist.gov /vuln/detail/CVE-2014-0002
advisory
github.com /apache/camel
package
issues.apache.org /jira/browse/CAMEL-7129
web
lists.apache.org /thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E
web
lists.apache.org /thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E
web
web.archive.org /web/20200229061309/http://www.securityfocus.com/bid/65901
web

Sources

CVE List CVE-2014-0002
GitHub Advisory GHSA-2fw5-rvf2-jq56
NVD CVE-2014-0002

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary