Unscored severity · published Mar 21, 2014
CVE-2014-0002
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML…
–
CVSS
27.4%
EPSS
No
On KEV
Description
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)27.4% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Camel · Apache
through 2.11.3; 1.0.0; 1.1.0; 1.2.0; 1.3.0; 1.4.0; +25 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0002
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0002
Exploit
http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-0371.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-0372.html
Vendor Advisory
http://secunia.com/advisories/57125
secunia.com
http://secunia.com/advisories/57716
secunia.com
http://secunia.com/advisories/57719
More from Camel
10.0
CVE-2026-33453
Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution
9.9
CVE-2026-40453
Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection
9.8
CVE-2026-80351
Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod
9.8
CVE-2026-80352
Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects
9.8
CVE-2026-78329
Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes