CVE-2015-0264 json
Apache Camel allows remote actor to read arbitrary files via external entity in invalid XML string or GenericFile object
published 2015-06-03 11 y ago modified 2026-06-17 4 mo ago also GHSA-mhx2-r3jx-g94c , EUVD-2018-0641
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 7.1%
- EPSS 7.1% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known
Summary
Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.
Patch / fix
- maven org.apache.camel:camel-core 2.13.4, 2.14.2
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2015-0264 updated cvss 5.0
Camel: XXE via XPath expression evaluation
-
Red Hat OpenShift Enterprise 1 camelaffected: no fix planned “Will not fix”
-
Red Hat OpenShift Enterprise 2 camelaffected: no fix available
-
Red Hat JBoss A-MQ 6.1fixed: vendor fix RHSA-2015:1041
-
Red Hat JBoss BPMS 6.0fixed: vendor fix RHSA-2015:1539
-
Red Hat JBoss BRMS 6.0fixed: vendor fix RHSA-2015:1538
-
Red Hat JBoss Fuse 6.1fixed: vendor fix RHSA-2015:1041
-
Red Hat JBoss Fuse Service Works 6.2fixed: vendor fix RHSA-2015:2558
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
7.10% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.camel:camel-core | <2.13.4 >=2.14.0, <2.14.2 |
2.13.4 2.14.2 |
References
-
github.com
/apache/camel/commit/7360aada5154434c68774aa30e0f21ddc5f27b9f
web
-
github.com
/apache/camel/commit/b47b51a195b38e7ab7c099d19910af70a16638f6
web
-
rhn.redhat.com
/errata/RHSA-2015-1539.html
vendor-advisory, web
-
rhn.redhat.com
/errata/RHSA-2015-1041.html
vendor-advisory, web
-
rhn.redhat.com
/errata/RHSA-2015-1538.html
vendor-advisory, web
-
camel.apache.org
/security-advisories.data/CVE-2015-0264.txt.asc
web, vendor-advisory
-
securitytracker.com
/id/1032442
vdb-entry, web
- git-wip-us.apache.org /repos/asf?p=camel.git%3Ba=commitdiff%3Bh=1df559649a96a1ca0368373387e542f46e4820da
-
lists.apache.org
/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E
mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2015-0264
advisory
-
git-wip-us.apache.org
/repos/asf?p=camel.git;a=commitdiff;h=1df559649a96a1ca0368373387e542f46e4820da
web
-
github.com
/advisories/GHSA-mhx2-r3jx-g94c
advisory
-
github.com
/apache/camel
package
-
issues.apache.org
/jira/browse/CAMEL-8312
web
-
lists.apache.org
/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E
web
-
lists.apache.org
/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E
web
Sources
- CVE List CVE-2015-0264
- GitHub Advisory GHSA-mhx2-r3jx-g94c
- NVD CVE-2015-0264
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.