VulnerabilityModified
CVE-2013-4330
Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileName message header to a (1) FILE or (2) FTP producer.
MEDIUM 6.8EPSS 8.52%
Does this matter?
Lower severity and a low EPSS score (8.52%). Track it; it rarely justifies an emergency change on its own.
Description
Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileName message header to a (1) FILE or (2) FTP producer.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 8.52% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- apache/camel
- Source
- secalert@redhat.com
References
- http://camel.apache.org/security-advisories.data/CVE-2013-4330.txt.asc?version=1&modificationDate=1380535446943Vendor Advisory
- http://osvdb.org/97941
- http://packetstormsecurity.com/files/123454/
- http://rhn.redhat.com/errata/RHSA-2013-1862.html
- http://rhn.redhat.com/errata/RHSA-2014-0124.html
- http://rhn.redhat.com/errata/RHSA-2014-0140.html
- http://rhn.redhat.com/errata/RHSA-2014-0245.html
- http://rhn.redhat.com/errata/RHSA-2014-0254.html
- http://seclists.org/fulldisclosure/2013/Sep/178
- http://secunia.com/advisories/54888Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/87542
- https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E
- http://camel.apache.org/security-advisories.data/CVE-2013-4330.txt.asc?version=1&modificationDate=1380535446943Vendor Advisory
- http://osvdb.org/97941
- http://packetstormsecurity.com/files/123454/
- http://rhn.redhat.com/errata/RHSA-2013-1862.html
- http://rhn.redhat.com/errata/RHSA-2014-0124.html
- http://rhn.redhat.com/errata/RHSA-2014-0140.html
- http://rhn.redhat.com/errata/RHSA-2014-0245.html
- http://rhn.redhat.com/errata/RHSA-2014-0254.html
- http://seclists.org/fulldisclosure/2013/Sep/178
- http://secunia.com/advisories/54888Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/87542
- https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.