Camel CVE-2020-11994

HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2020-07-08 security@apache.org

Code Injection Camel Communications Diameter Signaling Router Enterprise Manager Base Platform Enterprise Repository

7.5

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

1

CVE Published

Jul 08, 2020 - 16:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

7 maven packages depend on org.apache.camel:camel-robotframework (2 direct, 5 indirect)

Ecosystem-wide dependent count for version 3.4.0.

DescriptionNVD

Server-Side Template Injection and arbitrary file disclosure on Camel templating components

AnalysisAI

Server-Side Template Injection and arbitrary file disclosure on Camel templating components. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-74. Server-Side Template Injection and arbitrary file disclosure on Camel templating components Affected products include: Apache Camel, Oracle Communications Diameter Signaling Router, Oracle Enterprise Manager Base Platform, Oracle Enterprise Repository.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Camel

View all

CVE-2025-27636 MEDIUM This Month POC

Bypass/Injection vulnerability in Apache Camel components under particular conditions.10.0 through <= 4.10.1, from 4.8.0

CVE-2014-0002 HIGH Act Now POC

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary file

CVE-2016-8749 CRITICAL Act Now POC

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks. Rated cri

CVE-2014-0003 HIGH Act Now POC

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remo

CVE-2026-23552 CRITICAL Act Now POC

Cross-realm token acceptance bypass in Apache Camel Keycloak security policy. The KeycloakSecurityPolicy fails to proper

CVE-2026-25747 HIGH This Week POC

Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSeria

CVE-2026-40473 HIGH This Week POC

The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInp

CVE-2019-0194 HIGH This Week POC

Apache Camel's File is vulnerable to directory traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely

CVE-2017-12634 CRITICAL Act Now

The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-se

CVE-2015-5344 CRITICAL Act Now

The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arb

CVE-2017-12633 CRITICAL Act Now

The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-s

CVE-2013-4330 MEDIUM This Month

Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arb

Same weakness CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

View all

CVE-2013-2251 CRITICAL POC

CVE-2016-4010 CRITICAL POC

CVE-2015-1592 HIGH POC

CVE-2025-20281 CRITICAL POC

CVE-2015-7309 MEDIUM POC

CVE-2014-8423 CRITICAL POC

CVE-2020-8468 HIGH POC

CVE-2015-3253 CRITICAL

Same technique Code Injection

View all

CVE-2012-0158 HIGH POC

CVE-2014-6287 CRITICAL POC

CVE-2017-7494 CRITICAL POC

CVE-2025-24893 CRITICAL POC

CVE-2025-47812 CRITICAL POC

CVE-2013-3906 HIGH POC

CVE-2017-9822 HIGH POC

CVE-2018-1273 CRITICAL POC

Share

CVE-2020-11994 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy