{"id":"CVE-2013-4330","aliases":["EUVD-2022-5751","GHSA-x9fv-c87w-55wc","RHSA-2014:0245","RHSA-2014:0254"],"status":"published","title":"Improper Control of Generation of Code in Apache Camel","description":"Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including \"$simple{}\" in a CamelFileName message header to a (1) FILE or (2) FTP producer.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.08492,"percentile":0.95068,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2013-10-04T17:00:00Z","modified":"2026-08-05T10:45:53Z","fixes":[{"ecosystem":"Maven","package":"org.apache.camel:camel-core","fixed_in":["2.9.7","2.10.7","2.11.2","2.12.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.camel:camel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.camel:camel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.camel:camel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.11.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.camel:camel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.0"},{"last_affected":"2.12.0"},{"fixed":"2.12.1"}]}],"versions":["2.12.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.camel:camel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7"}]}],"versions":["1.0.0","1.1.0","1.2.0","1.3.0","1.4.0","1.5.0","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","2.0-M1","2.0-M2","2.0-M3","2.0.0","2.1.0","2.2.0","2.3.0","2.4.0","2.5.0","2.6.0","2.7.0","2.7.1","2.7.2","2.7.3","2.7.4","2.7.5","2.8.0","2.8.1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.9.0","2.9.0-RC1","2.9.1","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.camel:camel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.7"}]}],"versions":["2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.camel:camel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.11.2"}]}],"versions":["2.11.0","2.11.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.camel:camel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.0"},{"fixed":"2.12.1"}]}],"versions":["2.12.0"]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.9.0-4.redhat.610328.el6op"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"activemq-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.9.0-4.redhat.610328.el6op"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.9.0-4.redhat.610328.el6op"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"activemq-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.9.0-4.redhat.610328.el6op"}]}],"bundled":4}],"products":[{"vendor":"apache","product":"camel"}],"references":[{"url":"http://secunia.com/advisories/54888","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2013/Sep/178","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1862.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/87542","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0140.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0124.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0254.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://osvdb.org/97941","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0245.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://camel.apache.org/security-advisories.data/CVE-2013-4330.txt.asc?version=1\u0026modificationDate=1380535446943","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://packetstormsecurity.com/files/123454/","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4330","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E","tags":["web"]},{"url":"https://github.com/apache/camel/commit/2281b1f365c50ee1a470fb9990b753eadee9095","tags":["web"]},{"url":"https://github.com/apache/camel/commit/27a9752a565fbef436bac4fcf22d339e3295b2a","tags":["web"]},{"url":"https://github.com/apache/camel/commit/3215fe50dd42c83a7a454dd36486843fe36eae4","tags":["web"]},{"url":"https://github.com/apache/camel/commit/5ba8f63f78f82b0cddf6cecbf59ac444a0cae2a6","tags":["web"]},{"url":"https://github.com/apache/camel/commit/ce19353f1297c5d3dc59be21a1ead89c0a44907","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/CAMEL-6748","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x9fv-c87w-55wc"},{"url":"https://github.com/apache/camel","tags":["web"]},{"url":"http://packetstormsecurity.com/files/123454","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0245","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=958618","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1000186","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1011726","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1049692","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0245.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2035","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2035","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2035","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4152","tags":["advisory"]},{"url":"http://www.gopivotal.com/security/cve-2013-4152","tags":["article"]},{"url":"https://github.com/SpringSource/spring-framework/pull/317","tags":["article"]},{"url":"https://jira.springsource.org/browse/SPR-10806","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4330","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4330","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0003","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0003","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0003","tags":["advisory"]},{"url":"http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0254","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0254.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-4330","description":"Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including \"$simple{}\" in a CamelFileName message header to a (1) FILE or (2) FTP producer.","status":"published","published":"2013-10-04T17:00:00Z","modified":"2024-08-06T16:38:02.021Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2022-5751","description":"Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including \"$simple{}\" in a CamelFileName message header to a (1) FILE or (2) FTP producer.","status":"published","published":"2013-10-04T17:00:00Z","modified":"2024-08-06T16:38:02Z","updated_at":"2026-11-03T01:56:32.187151Z"}],"ghsa":[{"id":"GHSA-x9fv-c87w-55wc","title":"Improper Control of Generation of Code in Apache Camel","description":"Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including \"$simple{}\" in a CamelFileName message header to a (1) FILE or (2) FTP producer.","status":"published","published":"2022-05-13T01:26:34Z","modified":"2023-12-19T21:58:03Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:37:27.414424Z"}],"nvd":[{"id":"CVE-2013-4330","description":"Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including \"$simple{}\" in a CamelFileName message header to a (1) FILE or (2) FTP producer.","status":"published","published":"2013-10-04T17:55:09.853Z","modified":"2026-06-16T23:57:02.41Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:02:38.715467Z"}],"osv":[{"id":"GHSA-x9fv-c87w-55wc","title":"Improper Control of Generation of Code in Apache Camel","description":"Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including \"$simple{}\" in a CamelFileName message header to a (1) FILE or (2) FTP producer.","status":"published","published":"2022-05-13T01:26:34Z","modified":"2024-12-06T05:39:49.45983Z","cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"RHSA-2014:0245","title":"Red Hat Security Advisory: activemq security update","status":"published","published":"2024-09-29T16:44:51Z","modified":"2026-08-05T10:02:26Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2014:0254","title":"Red Hat Security Advisory: activemq security update","status":"published","published":"2024-09-29T16:44:47Z","modified":"2026-08-05T10:45:53.569980625Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}