Read the docs
TI-2013-03793 Aliases CVE-2013-4330GHSA-x9fv-c87w-55wc

Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows…

Priority MEDIUM 41CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.

Summary

Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileName message header to a (1) FILE or (2) FTP producer.

Why it matters now

EPSS 0.08492 95th percentileScored 2026-11-07
Fix Fixed org.apache.camel:camel-core (Maven): 2.9.7, 2.10.7, 2.11.2 +1Red Hat: 6 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.camel:camel-core (Maven)before 2.9.72.9.7Patch availableGHSA-x9fv-c87w-55wc
—org.apache.camel:camel-core (Maven)2.10.0 to before 2.10.72.10.7Patch availableGHSA-x9fv-c87w-55wc
—org.apache.camel:camel-core (Maven)2.11.0 to before 2.11.22.11.2Patch availableGHSA-x9fv-c87w-55wc
—org.apache.camel:camel-core (Maven)2.12.0 to before 2.12.12.12.1Patch availableGHSA-x9fv-c87w-55wc
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.camel:camel-core (Maven) Vendor— Affected before 2.9.7 Fixed in 2.9.7 Patch available GHSA-x9fv-c87w-55wc
  • org.apache.camel:camel-core (Maven) Vendor— Affected 2.10.0 to before 2.10.7 Fixed in 2.10.7 Patch available GHSA-x9fv-c87w-55wc
  • org.apache.camel:camel-core (Maven) Vendor— Affected 2.11.0 to before 2.11.2 Fixed in 2.11.2 Patch available GHSA-x9fv-c87w-55wc
  • org.apache.camel:camel-core (Maven) Vendor— Affected 2.12.0 to before 2.12.1 Fixed in 2.12.1 Patch available GHSA-x9fv-c87w-55wc

CPE configurations NVD · 51

CPEVersionsRoleVendor
cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*up to 2.9.6VulnerableApache
cpe:2.3:a:apache:camel:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableApache
cpe:2.3:a:apache:camel:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableApache
cpe:2.3:a:apache:camel:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableApache
cpe:2.3:a:apache:camel:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableApache
cpe:2.3:a:apache:camel:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableApache
cpe:2.3:a:apache:camel:1.5.0:*:*:*:*:*:*:*1.5.0VulnerableApache
cpe:2.3:a:apache:camel:1.6.0:*:*:*:*:*:*:*1.6.0VulnerableApache
cpe:2.3:a:apache:camel:1.6.1:*:*:*:*:*:*:*1.6.1VulnerableApache
cpe:2.3:a:apache:camel:1.6.2:*:*:*:*:*:*:*1.6.2VulnerableApache
  • cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions up to 2.9.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·Apache
Show 41 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:camel:1.6.3:*:*:*:*:*:*:*1.6.3VulnerableApache
cpe:2.3:a:apache:camel:1.6.4:*:*:*:*:*:*:*1.6.4VulnerableApache
cpe:2.3:a:apache:camel:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableApache
cpe:2.3:a:apache:camel:2.0.0:milestone1:*:*:*:*:*:*2.0.0 milestone1VulnerableApache
cpe:2.3:a:apache:camel:2.0.0:milestone2:*:*:*:*:*:*2.0.0 milestone2VulnerableApache
cpe:2.3:a:apache:camel:2.0.0:milestone3:*:*:*:*:*:*2.0.0 milestone3VulnerableApache
cpe:2.3:a:apache:camel:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableApache
cpe:2.3:a:apache:camel:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableApache
cpe:2.3:a:apache:camel:2.3.0:*:*:*:*:*:*:*2.3.0VulnerableApache
cpe:2.3:a:apache:camel:2.4.0:*:*:*:*:*:*:*2.4.0VulnerableApache
cpe:2.3:a:apache:camel:2.5.0:*:*:*:*:*:*:*2.5.0VulnerableApache
cpe:2.3:a:apache:camel:2.6.0:*:*:*:*:*:*:*2.6.0VulnerableApache
cpe:2.3:a:apache:camel:2.7.0:*:*:*:*:*:*:*2.7.0VulnerableApache
cpe:2.3:a:apache:camel:2.7.1:*:*:*:*:*:*:*2.7.1VulnerableApache
cpe:2.3:a:apache:camel:2.7.2:*:*:*:*:*:*:*2.7.2VulnerableApache
cpe:2.3:a:apache:camel:2.7.3:*:*:*:*:*:*:*2.7.3VulnerableApache
cpe:2.3:a:apache:camel:2.7.4:*:*:*:*:*:*:*2.7.4VulnerableApache
cpe:2.3:a:apache:camel:2.7.5:*:*:*:*:*:*:*2.7.5VulnerableApache
cpe:2.3:a:apache:camel:2.8.0:*:*:*:*:*:*:*2.8.0VulnerableApache
cpe:2.3:a:apache:camel:2.8.1:*:*:*:*:*:*:*2.8.1VulnerableApache
cpe:2.3:a:apache:camel:2.8.2:*:*:*:*:*:*:*2.8.2VulnerableApache
cpe:2.3:a:apache:camel:2.8.3:*:*:*:*:*:*:*2.8.3VulnerableApache
cpe:2.3:a:apache:camel:2.8.4:*:*:*:*:*:*:*2.8.4VulnerableApache
cpe:2.3:a:apache:camel:2.8.5:*:*:*:*:*:*:*2.8.5VulnerableApache
cpe:2.3:a:apache:camel:2.8.6:*:*:*:*:*:*:*2.8.6VulnerableApache
cpe:2.3:a:apache:camel:2.9.0:*:*:*:*:*:*:*2.9.0VulnerableApache
cpe:2.3:a:apache:camel:2.9.1:*:*:*:*:*:*:*2.9.1VulnerableApache
cpe:2.3:a:apache:camel:2.9.2:*:*:*:*:*:*:*2.9.2VulnerableApache
cpe:2.3:a:apache:camel:2.9.3:*:*:*:*:*:*:*2.9.3VulnerableApache
cpe:2.3:a:apache:camel:2.9.4:*:*:*:*:*:*:*2.9.4VulnerableApache
cpe:2.3:a:apache:camel:2.9.5:*:*:*:*:*:*:*2.9.5VulnerableApache
cpe:2.3:a:apache:camel:2.10.0:*:*:*:*:*:*:*2.10.0VulnerableApache
cpe:2.3:a:apache:camel:2.10.1:*:*:*:*:*:*:*2.10.1VulnerableApache
cpe:2.3:a:apache:camel:2.10.2:*:*:*:*:*:*:*2.10.2VulnerableApache
cpe:2.3:a:apache:camel:2.10.3:*:*:*:*:*:*:*2.10.3VulnerableApache
cpe:2.3:a:apache:camel:2.10.4:*:*:*:*:*:*:*2.10.4VulnerableApache
cpe:2.3:a:apache:camel:2.10.5:*:*:*:*:*:*:*2.10.5VulnerableApache
cpe:2.3:a:apache:camel:2.10.6:*:*:*:*:*:*:*2.10.6VulnerableApache
cpe:2.3:a:apache:camel:2.11.0:*:*:*:*:*:*:*2.11.0VulnerableApache
cpe:2.3:a:apache:camel:2.11.1:*:*:*:*:*:*:*2.11.1VulnerableApache
cpe:2.3:a:apache:camel:2.12.0:*:*:*:*:*:*:*2.12.0VulnerableApache
  • cpe:2.3:a:apache:camel:1.6.3:*:*:*:*:*:*:* Versions 1.6.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:1.6.4:*:*:*:*:*:*:* Versions 1.6.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.0.0:milestone1:*:*:*:*:*:* Versions 2.0.0 milestone1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.0.0:milestone2:*:*:*:*:*:* Versions 2.0.0 milestone2 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.0.0:milestone3:*:*:*:*:*:* Versions 2.0.0 milestone3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.7.2:*:*:*:*:*:*:* Versions 2.7.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.7.3:*:*:*:*:*:*:* Versions 2.7.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.7.4:*:*:*:*:*:*:* Versions 2.7.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.7.5:*:*:*:*:*:*:* Versions 2.7.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.8.0:*:*:*:*:*:*:* Versions 2.8.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.8.1:*:*:*:*:*:*:* Versions 2.8.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.8.2:*:*:*:*:*:*:* Versions 2.8.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.8.3:*:*:*:*:*:*:* Versions 2.8.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.8.4:*:*:*:*:*:*:* Versions 2.8.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.8.5:*:*:*:*:*:*:* Versions 2.8.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.8.6:*:*:*:*:*:*:* Versions 2.8.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.9.0:*:*:*:*:*:*:* Versions 2.9.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.9.1:*:*:*:*:*:*:* Versions 2.9.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.9.2:*:*:*:*:*:*:* Versions 2.9.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.9.3:*:*:*:*:*:*:* Versions 2.9.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.9.4:*:*:*:*:*:*:* Versions 2.9.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.9.5:*:*:*:*:*:*:* Versions 2.9.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.0:*:*:*:*:*:*:* Versions 2.10.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.1:*:*:*:*:*:*:* Versions 2.10.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.2:*:*:*:*:*:*:* Versions 2.10.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.3:*:*:*:*:*:*:* Versions 2.10.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.4:*:*:*:*:*:*:* Versions 2.10.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.5:*:*:*:*:*:*:* Versions 2.10.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.10.6:*:*:*:*:*:*:* Versions 2.10.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.11.0:*:*:*:*:*:*:* Versions 2.11.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.11.1:*:*:*:*:*:*:* Versions 2.11.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:camel:2.12.0:*:*:*:*:*:*:* Versions 2.12.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-x9fv-c87w-55wc org.apache.camel:camel-core (Maven) Fixed in 2.9.7 Advisory →
  • Fix · GHSA-x9fv-c87w-55wc org.apache.camel:camel-core (Maven) Fixed in 2.10.7 Advisory →
  • Fix · GHSA-x9fv-c87w-55wc org.apache.camel:camel-core (Maven) Fixed in 2.11.2 Advisory →
  • Fix · GHSA-x9fv-c87w-55wc org.apache.camel:camel-core (Maven) Fixed in 2.12.1 Advisory →

Red Hat 6 advisories

  • RHSA-2014:0254 Released 2014-03-05 · Red Hat rating Important
    activemq security update
    • RHOSE Infrastructure 1.2 activemq-5.9.0-4.redhat.610328.el6op, activemq-client-5.9.0-4.redhat.610328.el6op
    • Red Hat OpenShift Enterprise Node activemq-5.9.0-4.redhat.610328.el6op, activemq-client-5.9.0-4.redhat.610328.el6op
  • RHSA-2014:0245 Released 2014-03-03 · Red Hat rating Important
    activemq security update
    • RHOSE Infrastructure 2.0 activemq-5.9.0-4.redhat.610328.el6op, activemq-client-5.9.0-4.redhat.610328.el6op
    • RHOSE Node 2.0 activemq-5.9.0-4.redhat.610328.el6op, activemq-client-5.9.0-4.redhat.610328.el6op
  • RHSA-2014:0140 Released 2014-02-05 · Red Hat rating Important
    Apache Camel security update
    • Red Hat JBoss BPMS 6.0
    • Red Hat JBoss BRMS 6.0
Show 3 more Red Hat advisories
  • RHSA-2014:0124 Released 2014-01-30 · Red Hat rating Important
    Apache Camel security update
    • Red Hat JBoss Fuse Service Works 6.0
  • RHSA-2013:1862 Released 2013-12-19 · Red Hat rating Important
    Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update
    • Fuse ESB Enterprise 7.1.0
    • Fuse MQ Enterprise 7.1.0
    • Fuse Management Console 7.1.0
  • RHSA-2013:1410 Released 2013-10-07 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.0.0 patch 4
    • Red Hat JBoss A-MQ 6.0
    • Red Hat JBoss Fuse 6.0

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Fuse ESB Enterprise 7.1.0Fixed RHSA-2013:1862
Fuse MQ Enterprise 7.1.0Fixed RHSA-2013:1862
Fuse Management Console 7.1.0Fixed RHSA-2013:1862
RHOSE Infrastructure 1.2Fixed RHSA-2014:0254
RHOSE Infrastructure 2.0Fixed RHSA-2014:0245
RHOSE Node 2.0Fixed RHSA-2014:0245
Red Hat JBoss A-MQ 6.0Fixed RHSA-2013:1410
Red Hat JBoss BPMS 6.0Fixed RHSA-2014:0140
Red Hat JBoss BRMS 6.0Fixed RHSA-2014:0140
Red Hat JBoss Fuse 6.0Fixed RHSA-2013:1410
Red Hat JBoss Fuse Service Works 6.0Fixed RHSA-2014:0124
Red Hat OpenShift Enterprise NodeFixed RHSA-2014:0254

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4330
  2. 2026-10-03 Alias added: GHSA-x9fv-c87w-55wc
  3. 2026-10-21 EPSS moved to the 95th–99th percentile
  4. 2026-10-25 EPSS moved to the 90th–95th percentile
  5. 2026-10-27 EPSS moved to the 95th–99th percentile

References

Advisory 7

Other 15

  • TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
  • TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
  • TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
  • TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
  • TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
  • TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
See all 116 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences