XML External Entity Vulnerability in Apache Camel Software

CVE-2015-0263

Summary

An XML external entity (XXE) vulnerability exists in the XML converter of Apache Camel, found in converter/jaxp/XmlConverter.java. This flaw permits remote attackers to exploit the SAXSource and read arbitrary files from the server. Prior to the updates in version 2.13.4 and 2.14.2, an attacker can craft a malicious XML that leads to unauthorized file access, exposing sensitive information and potentially allowing further system exploitation.

References