CVE-2015-0263
Apache Camel XML External Entity vulnerability
XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.
Exploit likelihood
What each source reports
NVD Score used
XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.
- Record
CVE-2015-0263- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.
- Record
CVE-2015-0263- Updated
- 2026-11-02
EUVDEUVD-2018-0487 No score
XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.
- Record
EUVD-2018-0487- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3hrc-f439-727g No score
Apache Camel XML External Entity vulnerability
XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.
- Record
GHSA-3hrc-f439-727g- Weakness
- CWE-611
- Updated
- 2026-11-02
OSVGHSA-3hrc-f439-727g No score
Apache Camel XML External Entity vulnerability
XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.
- Record
GHSA-3hrc-f439-727g- Weakness
- CWE-611
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.camel:camel-coreMaven |
before 2.13.4 | 2.13.4 |
org.apache.camel:camel-coreMaven |
2.14.0 up to 2.14.2 | 2.14.2 |
org.apache.camel:camel-coreMaven |
before 2.13.4, plus listed versions 1.0.01.1.01.2.01.3.01.4.0 Show 45 moreShow less1.5.01.6.01.6.11.6.21.6.31.6.42.0-M12.0-M22.0-M32.0.02.1.02.10.02.10.12.10.22.10.32.10.42.10.52.10.62.10.72.11.02.11.12.11.22.11.32.11.42.12.02.12.12.12.22.12.32.12.42.12.52.13.02.13.12.13.22.13.32.2.02.3.02.4.02.5.02.6.02.7.02.7.12.7.22.7.32.7.42.7.5 |
2.13.4 |
org.apache.camel:camel-coreMaven |
2.14.0 up to 2.14.2, plus listed versions 2.14.1 |
2.14.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-0263 is a medium vulnerability (CVSS 5.0) in Apache Camel, published June 3, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.47%, the 94th percentile. Fixed in org.apache.camel:camel-core 2.13.4.
References
rhn.redhat.com/errata/RHSA-2015-1539.html
git-wip-us.apache.org/repos/asf?p=camel.git%3Ba=commitdiff%3Bh=7d19340bcdb42f7aae584d9c5003ac4f7ddaee36
securitytracker.com/id/1032442
camel.apache.org/security-advisories.data/CVE-2015-0263.txt.asc
Show 12 moreShow less
lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2015-0263
github.com/advisories/GHSA-3hrc-f439-727g
issues.apache.org/jira/browse/CAMEL-8312
Left out here: 17 versions. The JSON record has them.