Vulnerabilities > CVE-2019-0188 - XXE vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

oracle

apache

CWE-611

NVD

Published: 2019-05-28

Updated: 2023-11-07

Summary

Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.

Vulnerable Configurations

Part	Description	Count
Application	Oracle Oracle Flexcube Private Banking 12.1.0 Oracle Flexcube Private Banking 12.0.0 Oracle Enterprise Manager Base Platform 13.3.0.0 Oracle Enterprise Manager Base Platform 13.4.0.0 Oracle Enterprise Data Quality 11.1.1.9.0 Oracle Enterprise Repository 12.1.3.0.0	6
Application	Apache Apache Camel - Apache Camel 1.0.0 Apache Camel 1.1.0 Apache Camel 1.2.0 Apache Camel 1.3.0 Apache Camel 1.4.0 Apache Camel 1.5.0 Apache Camel 1.6.0 Apache Camel 1.6.1 Apache Camel 1.6.2 Apache Camel 1.6.3 Apache Camel 1.6.4 Apache Camel 2.0.0 Apache Camel 2.1.0 Apache Camel 2.2.0 Apache Camel 2.3.0 Apache Camel 2.4.0 Apache Camel 2.5.0 Apache Camel 2.6.0 Apache Camel 2.7.0 Apache Camel 2.7.1 Apache Camel 2.7.2 Apache Camel 2.7.3 Apache Camel 2.7.4 Apache Camel 2.7.5 Apache Camel 2.8.0 Apache Camel 2.8.1 Apache Camel 2.8.2 Apache Camel 2.8.3 Apache Camel 2.8.4 Apache Camel 2.8.5 Apache Camel 2.8.6 Apache Camel 2.9.0 Apache Camel 2.9.1 Apache Camel 2.9.2 Apache Camel 2.9.3 Apache Camel 2.9.4 Apache Camel 2.9.5 Apache Camel 2.9.6 Apache Camel 2.9.7 Apache Camel 2.9.8 Apache Camel 2.10.0 Apache Camel 2.10.1 Apache Camel 2.10.2 Apache Camel 2.10.3 Apache Camel 2.10.4 Apache Camel 2.10.5 Apache Camel 2.10.6 Apache Camel 2.10.7 Apache Camel 2.11.0 Apache Camel 2.11.1 Apache Camel 2.11.2 Apache Camel 2.11.3 Apache Camel 2.11.4 Apache Camel 2.12.0 Apache Camel 2.12.1 Apache Camel 2.12.2 Apache Camel 2.12.3 Apache Camel 2.12.4 Apache Camel 2.12.5 Apache Camel 2.13.0 Apache Camel 2.13.1 Apache Camel 2.13.2 Apache Camel 2.13.3 Apache Camel 2.13.4 Apache Camel 2.14.0 Apache Camel 2.14.1 Apache Camel 2.14.2 Apache Camel 2.14.3 Apache Camel 2.14.4 Apache Camel 2.15.0 Apache Camel 2.15.1 Apache Camel 2.15.2 Apache Camel 2.15.3 Apache Camel 2.15.4 Apache Camel 2.15.5 Apache Camel 2.15.6 Apache Camel 2.16.0 Apache Camel 2.16.1 Apache Camel 2.16.2 Apache Camel 2.16.3 Apache Camel 2.16.4 Apache Camel 2.16.5 Apache Camel 2.17.0 Apache Camel 2.17.1 Apache Camel 2.17.2 Apache Camel 2.17.3 Apache Camel 2.17.4 Apache Camel 2.17.5 Apache Camel 2.17.6 Apache Camel 2.17.7 Apache Camel 2.18.0 Apache Camel 2.18.1 Apache Camel 2.18.2 Apache Camel 2.18.3 Apache Camel 2.18.4 Apache Camel 2.18.5 Apache Camel 2.19.0 Apache Camel 2.19.1 Apache Camel 2.19.2 Apache Camel 2.19.3 Apache Camel 2.19.4 Apache Camel 2.19.5 Apache Camel 2.20.0 Apache Camel 2.20.1 Apache Camel 2.20.2 Apache Camel 2.20.3 Apache Camel 2.20.4 Apache Camel 2.21.0 Apache Camel 2.21.1 Apache Camel 2.21.2 Apache Camel 2.21.3 Apache Camel 2.21.4 Apache Camel 2.21.5 Apache Camel 2.22.0 Apache Camel 2.22.1 Apache Camel 2.22.2 Apache Camel 2.22.3 Apache Camel 2.22.4 Apache Camel 2.22.5 Apache Camel 2.23.0 Apache Camel 2.23.1 Apache Camel 2.23.2 Apache Camel 2.23.3 Apache Camel 2.23.4	150

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References