CVE-2014-0002
Apache Camel's XSLT component allows remote attackers to read arbitrary files
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Exploit likelihood
What each source reports
NVD Score used
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
CVE-2014-0002- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
CVE-2014-0002- Updated
- 2026-11-02
EUVDEUVD-2018-0475 No score
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
EUVD-2018-0475- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2fw5-rvf2-jq56 No score
Apache Camel's XSLT component allows remote attackers to read arbitrary files
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
GHSA-2fw5-rvf2-jq56- Updated
- 2026-11-02
OSVGHSA-2fw5-rvf2-jq56 No score
Apache Camel's XSLT component allows remote attackers to read arbitrary files
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
GHSA-2fw5-rvf2-jq56- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.camel:camel-coreMaven |
before 2.11.4 | 2.11.4 |
org.apache.camel:camel-coreMaven |
2.12.0 up to 2.12.3 | 2.12.3 |
org.apache.camel:camel-coreMaven |
before 2.11.4, plus listed versions 1.0.01.1.01.2.01.3.01.4.0 Show 45 moreShow less1.5.01.6.01.6.11.6.21.6.31.6.42.0-M12.0-M22.0-M32.0.02.1.02.10.02.10.12.10.22.10.32.10.42.10.52.10.62.10.72.11.02.11.12.11.22.11.32.2.02.3.02.4.02.5.02.6.02.7.02.7.12.7.22.7.32.7.42.7.52.8.02.8.12.8.22.8.32.8.42.8.52.8.62.9.02.9.0-RC12.9.12.9.2 |
2.11.4 |
org.apache.camel:camel-coreMaven |
2.12.0 up to 2.12.3, plus listed versions 2.12.12.12.2 |
2.12.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-0002 is a high vulnerability (CVSS 7.5) in Apache Camel, published March 20, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 27.4%, the 98th percentile. Fixed in org.apache.camel:camel-core 2.11.4.
References
secunia.com/advisories/57125
rhn.redhat.com/errata/RHSA-2014-0371.html
camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc
securityfocus.com/bid/65901
Show 13 moreShow less
lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2014-0002
web.archive.org/web/20200229061309/http://www.securityfocus.com/bid/65901
github.com/apache/camel/commit/2ec54fa0c13ae65bdcccff764af081a79fcc05f
issues.apache.org/jira/browse/CAMEL-7129
Left out here: 6 versions. The JSON record has them.