CVE-2015-0263 json
Apache Camel XML External Entity vulnerability
published 2015-06-03 11 y ago modified 2026-06-17 4 mo ago also GHSA-3hrc-f439-727g , EUVD-2018-0487
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 7.5%
- EPSS 7.5% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known
Summary
XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.
Patch / fix
- maven org.apache.camel:camel-core 2.13.4, 2.14.2
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2015-0263 updated cvss 5.0
Camel: XXE in via SAXSource expansion
-
Red Hat OpenShift Enterprise 1 camelaffected: no fix planned “Will not fix”
-
Red Hat OpenShift Enterprise 2 camelaffected: no fix available
-
Red Hat JBoss A-MQ 6.1fixed: vendor fix RHSA-2015:1041
-
Red Hat JBoss BPMS 6.0fixed: vendor fix RHSA-2015:1539
-
Red Hat JBoss BRMS 6.0fixed: vendor fix RHSA-2015:1538
-
Red Hat JBoss Fuse 6.1fixed: vendor fix RHSA-2015:1041
-
Red Hat JBoss Fuse Service Works 6.2fixed: vendor fix RHSA-2015:2558
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
7.47% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.camel:camel-core | <2.13.4 >=2.14.0, <2.14.2 |
2.13.4 2.14.2 |
Classification
- Weakness
-
- CWE-611 Improper Restriction of XML External Entity Reference
References
-
github.com
/apache/camel/commit/06db9e0744f2bb9f6e3bf16c0dfe7099a3481558
web
-
github.com
/apache/camel/commit/367d53e73c8b5a1e73c24423e631709f9a96e08d
web
-
github.com
/apache/camel/commit/7d19340bcdb42f7aae584d9c5003ac4f7ddaee36
web
-
rhn.redhat.com
/errata/RHSA-2015-1539.html
vendor-advisory, web
-
rhn.redhat.com
/errata/RHSA-2015-1041.html
vendor-advisory, web, release-notes
-
rhn.redhat.com
/errata/RHSA-2015-1538.html
vendor-advisory, web, release-notes
-
camel.apache.org
/security-advisories.data/CVE-2015-0263.txt.asc
web, vendor-advisory
- git-wip-us.apache.org /repos/asf?p=camel.git%3Ba=commitdiff%3Bh=7d19340bcdb42f7aae584d9c5003ac4f7ddaee36
-
securitytracker.com
/id/1032442
vdb-entry, web, third-party-advisory
-
lists.apache.org
/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E
mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2015-0263
advisory
-
git-wip-us.apache.org
/repos/asf?p=camel.git;a=commitdiff;h=7d19340bcdb42f7aae584d9c5003ac4f7ddaee36
web
-
github.com
/advisories/GHSA-3hrc-f439-727g
advisory
-
github.com
/apache/camel
package
-
issues.apache.org
/jira/browse/CAMEL-8312
web
-
lists.apache.org
/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E
web
-
lists.apache.org
/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E
web
Sources
- CVE List CVE-2015-0263
- GitHub Advisory GHSA-3hrc-f439-727g
- NVD CVE-2015-0263
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.