XML external entity (XXE) vulnerability in the XML converter setup in…
Priority LOW 33CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- Partial Red Hat: 5 fixed, 2 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-611 and the CVSS impact.
Summary
XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.
Why it matters now
EPSS 0.07474 94th percentileScored 2026-11-07
Fix Partial org.apache.camel:camel-core (Maven): 2.13.4, 2.14.2Red Hat: 4 advisoriesRed Hat: 5 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.camel:camel-core (Maven) | before 2.13.4 | 2.13.4 | Patch available | GHSA-3hrc-f439-727g |
| — | org.apache.camel:camel-core (Maven) | 2.14.0 to before 2.14.2 | 2.14.2 | Patch available | GHSA-3hrc-f439-727g |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.camel:camel-core (Maven) Vendor— Affected before 2.13.4 Fixed in 2.13.4 Patch available GHSA-3hrc-f439-727g
- org.apache.camel:camel-core (Maven) Vendor— Affected 2.14.0 to before 2.14.2 Fixed in 2.14.2 Patch available GHSA-3hrc-f439-727g
Remediation
- Fix · GHSA-3hrc-f439-727g org.apache.camel:camel-core (Maven) Fixed in 2.13.4 Advisory →
- Fix · GHSA-3hrc-f439-727g org.apache.camel:camel-core (Maven) Fixed in 2.14.2 Advisory →
Red Hat 4 advisories
- RHSA-2015:2558 Released 2015-12-07 · Red Hat rating ImportantRed Hat JBoss Fuse Service Works 6.2.1 update
- Red Hat JBoss Fuse Service Works 6.2
- RHSA-2015:1538 Released 2015-08-03 · Red Hat rating ModerateRed Hat JBoss BRMS 6.1.2 update
- Red Hat JBoss BRMS 6.0
- RHSA-2015:1539 Released 2015-08-03 · Red Hat rating ModerateRed Hat JBoss BPM Suite 6.1.2 update
- Red Hat JBoss BPMS 6.0
Show 1 more Red Hat advisories
- RHSA-2015:1041 Released 2015-06-01 · Red Hat rating ModerateRed Hat JBoss Fuse/A-MQ 6.1.0 update
- Red Hat JBoss A-MQ 6.1
- Red Hat JBoss Fuse 6.1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Enterprise 1 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Enterprise 2 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6.1 | Fixed | RHSA-2015:1041 |
| Red Hat JBoss BPMS 6.0 | Fixed | RHSA-2015:1539 |
| Red Hat JBoss BRMS 6.0 | Fixed | RHSA-2015:1538 |
| Red Hat JBoss Fuse 6.1 | Fixed | RHSA-2015:1041 |
| Red Hat JBoss Fuse Service Works 6.2 | Fixed | RHSA-2015:2558 |
Timeline
- 2026-10-02 Threatist record created from CVE-2015-0263
- 2026-10-03 Alias added: GHSA-3hrc-f439-727g
References
Advisory 6
Other 11
- https://git-wip-us.apache.org/repos/asf?p=camel.git%3Ba=commitdiff%3Bh=7d19340bcdb42f7aae584d9c5003ac4f7ddaee36
- [camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html
- [camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html
- https://github.com/apache/camel/commit/06db9e0744f2bb9f6e3bf16c0dfe7099a3481558
- https://github.com/apache/camel/commit/367d53e73c8b5a1e73c24423e631709f9a96e08d
- https://github.com/apache/camel/commit/7d19340bcdb42f7aae584d9c5003ac4f7ddaee36
- https://git-wip-us.apache.org/repos/asf?p=camel.git;a=commitdiff;h=7d19340bcdb42f7aae584d9c5003ac4f7ddaee36
- https://github.com/apache/camel
- https://issues.apache.org/jira/browse/CAMEL-8312
- https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E
More Apache Camel vulnerabilities
- TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
- TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
- TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
- TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
- TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
- TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
Sources
- CVE-2015-0263 · CVE Program
- CVE-2015-0263 · NVD
- FIRST EPSS
- GHSA-3hrc-f439-727g · GitHub Advisory Database · CC BY 4.0
- CVE-2015-0263 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences