vulnwire
7.4high

CVE-2017-5643

Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.

Also known as GHSA-vq9j-jh62-5hmp

Published 9 y ago · modified 4 mo ago · JSON

CVSS
7.4
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
5.9%
percentile 93%
Public exploits
0
none known

Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.

Exploit prediction (EPSS)

5.86% probability of exploitation in the next 30 days, higher than 93% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.4CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
NVD2.05.8AV:N/AC:M/Au:N/C:P/I:P/A:N
GitHub3.07.4CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.camel:camel-core
<2.17.6
>=2.18.0, <2.18.2
2.17.6
2.18.2

Affected products

  • Apache Software Foundation Apache Camel

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

  • securityfocus.com /bid/97226 · vdb-entry, x_refsource_BID, x_transferred
  • access.redhat.com /errata/RHSA-2017:1832 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • camel.apache.org /security-advisories.data/CVE-2017-5643.txt.asc?version=1&modificationDate=1489652454000&a · x_refsource_CONFIRM, x_transferred
  • lists.apache.org /thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.a · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.a · mailing-list, x_refsource_MLIST, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-5643 · advisory
  • github.com /apache/camel/commit/2c6964ae94d8f9a9c9a32e5ae5a0b794e8b8d3be · web
  • github.com /apache/camel/commit/8afc5d1757795fde715902067360af5d90f046da · web
  • github.com /apache/camel/commit/9f7376abbff7434794f2c7c2909e02bac232fb5b · web
  • github.com /advisories/GHSA-vq9j-jh62-5hmp · advisory
  • github.com /apache/camel · web
  • issues.apache.org /jira/browse/CAMEL-10894 · web
  • lists.apache.org /thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apa · web
  • lists.apache.org /thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apa · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.