CVE-2015-0264: XXE in Apache Camel

June 3, 2015 (updated May 24, 2019)

Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in this package allow remote attackers to read arbitrary files via an external entity in an invalid XML String or GenericFile object in an XPath query.

References

camel.apache.org/security-advisories.html
camel.apache.org/security-advisories.data/CVE-2015-0264.txt.asc?version=1&modificationDate=1426539191000&api=v2
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0264

Code Behaviors & Features

Detect and mitigate CVE-2015-0264 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →