CVE-2020-11994

CWE-74CWE-8810 documents8 sources
Severity
7.5HIGH
EPSS
2.0%
top 16.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Apache CamelOracle Communications Diameter Signaling RouterOracle Enterprise Manager Base Platform+1 more
Timeline
PublishedJul 8
Latest updateOct 15

Description

Server-Side Template Injection and arbitrary file disclosure on Camel templating components

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

▶NVDapache/camel2.22.0 — 2.22.5+5
▶CVEListV5apache_camelCamel 2.25.0 to 2.25.1, Camel 3.0.0 to 3.3.0. The unsupported Camel 2.x (2.24 and earlier) versions may be also affected.

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
OSV
Server side template injection in Apache Camel↗2020-07-29
▶
GHSA
Server side template injection in Apache Camel↗2020-07-29
▶
CVEList
CVE-2020-11994: Server-Side Template Injection and arbitrary file disclosure on Camel templating components↗2020-07-08
▶

📋Vendor Advisories

5
Oracle
Oracle Oracle Communications Risk Matrix: IDIH - Visualization (Apache Camel) — CVE-2020-11994↗2021-10-15
▶
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Reporting Framework (Apache Camel) — CVE-2020-11994↗2021-04-15
▶
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Security Subsystem (Apache Camel) — CVE-2020-11994↗2021-01-15
▶
Red Hat
camel: server-side template injection and arbitrary file disclosure on templating components↗2020-07-08
▶
Apache
Apache camel: CVE-2020-11994↗
▶

💬Community

1
Bugzilla
CVE-2020-11994 camel: server-side template injection and arbitrary file disclosure on templating components↗2020-07-10
▶
CVE-2020-11994 (HIGH CVSS 7.5) | Server-Side Template Injection and | cvebase.io