CVE-2019-0188

Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.

Published: May 28, 2019
Updated: Nov 8, 2023
CVE: CVE-2019-0188
GHSA: GHSA-h896-mx9x-g32g
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:P/I:N/A:N

CWEs:

CWE-611

OWASP TOP 10:

A4 - XML External Entities (XXE)

Affected Software
References

Software	From	Fixed in
oracle / flexcube_private_banking	12.1.0	12.1.0.x
oracle / flexcube_private_banking	12.0.0	12.0.0.x
apache / camel	-	2.24.0
oracle / enterprise_manager_base_platform	13.3.0.0	13.3.0.0.x
oracle / enterprise_manager_base_platform	13.4.0.0	13.4.0.0.x
oracle / enterprise_data_quality	11.1.1.9.0	11.1.1.9.0.x
oracle / enterprise_repository	12.1.3.0.0	12.1.3.0.0.x
org.apache.camel / camel-core	-	2.24.0
org.apache.camel / camel-xmljson	-	2.23.4.x

Vulnerability Database

289,599

CVE-2019-0188