Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSO

Summary

Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.

Timeline

1. May 28, 2019, 6:10 PM UTCCVE published
2. Aug 4, 2024, 5:44 PM UTCRecord last updated

Affected versions

• Apache Apache Camel

  Apache Camel versions prior to 2.24.0

• org.apache.camel:camel-coreMaven

  fixed in 2.24.0

• org.apache.camel:camel-xmljsonMaven

  through 2.23.4

References 16