Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-8vfm-4388-6rpc
Advisory ID github_osv/GHSA-8vfm-4388-6rpc
Aliases CVE-2018-8027
Summary Apache is vulnerable to XXE in XSD validation processor Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.
Status Published
Exploitability 0.5
Weighted Severity 8.8
Risk 4.4
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-611 Improper Restriction of XML External Entity Reference
System Score Found at
cvssv3 9.8 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-8vfm-4388-6rpc/GHSA-8vfm-4388-6rpc.json
generic_textual CRITICAL
Reference id Reference type URL
http://camel.apache.org/security-advisories.data/CVE-2018-8027.txt.asc
https://github.com/advisories/GHSA-8vfm-4388-6rpc
https://github.com/apache/camel
https://github.com/apache/camel/commit/22c355bb4ffb500405499d189db30932ca5aac9
https://github.com/apache/camel/commit/24eefa559fe6b310629d2bf00663d2679ec81b9
https://github.com/apache/camel/commit/2c6964ae94d8f9a9c9a32e5ae5a0b794e8b8d3b
https://github.com/apache/camel/commit/2e8f21dec883b083ddcdddd802847b4c378a61a
https://github.com/apache/camel/commit/3fe03e361725b66c1c3eaa40bb11577fb3dc17b
https://github.com/apache/camel/commit/8467d644813a62f3a836c0c7dee8cf5a41de3c0
https://github.com/apache/camel/commit/87c92b7b38890c217bc76f2c55036e6a5cca9a0
https://github.com/apache/camel/commit/8afc5d1757795fde715902067360af5d90f046d
https://github.com/apache/camel/commit/99cbcd78b7e64083fae1d9552ead7425a90994b
https://github.com/apache/camel/commit/9c6a8f61de40c20f28240fbb2af4cb425793d41
https://github.com/apache/camel/commit/9f7376abbff7434794f2c7c2909e02bac232fb5
https://github.com/apache/camel/commit/ec3d0db81ba061b27e934d5ff56e9baca0049eb
https://issues.apache.org/jira/browse/CAMEL-10894
https://issues.apache.org/jira/browse/CAMEL-12444
https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E
https://lists.apache.org/thread.html/77f596fc63e63c2e9adcff3c34759b32c225cf0b582aedb755adaade@%3Cdev.camel.apache.org%3E
https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2018-8027
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-8vfm-4388-6rpc/GHSA-8vfm-4388-6rpc.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.