Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-dm16-ehy9-hkc5
Vulnerability ID VCID-dm16-ehy9-hkc5
Aliases CVE-2018-8027
GHSA-8vfm-4388-6rpc
Summary Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-611 Improper Restriction of XML External Entity Reference
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 9.8 http://camel.apache.org/security-advisories.data/CVE-2018-8027.txt.asc
generic_textual CRITICAL http://camel.apache.org/security-advisories.data/CVE-2018-8027.txt.asc
cvssv3 7.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-8027.json
epss 0.02526 https://api.first.org/data/v1/epss?cve=CVE-2018-8027
epss 0.02526 https://api.first.org/data/v1/epss?cve=CVE-2018-8027
epss 0.02526 https://api.first.org/data/v1/epss?cve=CVE-2018-8027
epss 0.02526 https://api.first.org/data/v1/epss?cve=CVE-2018-8027
epss 0.02526 https://api.first.org/data/v1/epss?cve=CVE-2018-8027
epss 0.02526 https://api.first.org/data/v1/epss?cve=CVE-2018-8027
epss 0.02526 https://api.first.org/data/v1/epss?cve=CVE-2018-8027
epss 0.02526 https://api.first.org/data/v1/epss?cve=CVE-2018-8027
epss 0.02526 https://api.first.org/data/v1/epss?cve=CVE-2018-8027
epss 0.02526 https://api.first.org/data/v1/epss?cve=CVE-2018-8027
epss 0.02526 https://api.first.org/data/v1/epss?cve=CVE-2018-8027
epss 0.02526 https://api.first.org/data/v1/epss?cve=CVE-2018-8027
epss 0.02526 https://api.first.org/data/v1/epss?cve=CVE-2018-8027
epss 0.02526 https://api.first.org/data/v1/epss?cve=CVE-2018-8027
epss 0.02526 https://api.first.org/data/v1/epss?cve=CVE-2018-8027
cvssv3.1 9.8 https://github.com/advisories/GHSA-8vfm-4388-6rpc
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-8vfm-4388-6rpc
generic_textual CRITICAL https://github.com/advisories/GHSA-8vfm-4388-6rpc
cvssv3.1 9.8 https://github.com/apache/camel
generic_textual CRITICAL https://github.com/apache/camel
cvssv3.1 9.8 https://github.com/apache/camel/commit/22c355bb4ffb500405499d189db30932ca5aac9
generic_textual CRITICAL https://github.com/apache/camel/commit/22c355bb4ffb500405499d189db30932ca5aac9
cvssv3.1 9.8 https://github.com/apache/camel/commit/24eefa559fe6b310629d2bf00663d2679ec81b9
generic_textual CRITICAL https://github.com/apache/camel/commit/24eefa559fe6b310629d2bf00663d2679ec81b9
cvssv3.1 9.8 https://github.com/apache/camel/commit/2c6964ae94d8f9a9c9a32e5ae5a0b794e8b8d3b
generic_textual CRITICAL https://github.com/apache/camel/commit/2c6964ae94d8f9a9c9a32e5ae5a0b794e8b8d3b
cvssv3.1 9.8 https://github.com/apache/camel/commit/2e8f21dec883b083ddcdddd802847b4c378a61a
generic_textual CRITICAL https://github.com/apache/camel/commit/2e8f21dec883b083ddcdddd802847b4c378a61a
cvssv3.1 9.8 https://github.com/apache/camel/commit/3fe03e361725b66c1c3eaa40bb11577fb3dc17b
generic_textual CRITICAL https://github.com/apache/camel/commit/3fe03e361725b66c1c3eaa40bb11577fb3dc17b
cvssv3.1 9.8 https://github.com/apache/camel/commit/8467d644813a62f3a836c0c7dee8cf5a41de3c0
generic_textual CRITICAL https://github.com/apache/camel/commit/8467d644813a62f3a836c0c7dee8cf5a41de3c0
cvssv3.1 9.8 https://github.com/apache/camel/commit/87c92b7b38890c217bc76f2c55036e6a5cca9a0
generic_textual CRITICAL https://github.com/apache/camel/commit/87c92b7b38890c217bc76f2c55036e6a5cca9a0
cvssv3.1 9.8 https://github.com/apache/camel/commit/8afc5d1757795fde715902067360af5d90f046d
generic_textual CRITICAL https://github.com/apache/camel/commit/8afc5d1757795fde715902067360af5d90f046d
cvssv3.1 9.8 https://github.com/apache/camel/commit/99cbcd78b7e64083fae1d9552ead7425a90994b
generic_textual CRITICAL https://github.com/apache/camel/commit/99cbcd78b7e64083fae1d9552ead7425a90994b
cvssv3.1 9.8 https://github.com/apache/camel/commit/9c6a8f61de40c20f28240fbb2af4cb425793d41
generic_textual CRITICAL https://github.com/apache/camel/commit/9c6a8f61de40c20f28240fbb2af4cb425793d41
cvssv3.1 9.8 https://github.com/apache/camel/commit/9f7376abbff7434794f2c7c2909e02bac232fb5
generic_textual CRITICAL https://github.com/apache/camel/commit/9f7376abbff7434794f2c7c2909e02bac232fb5
cvssv3.1 9.8 https://github.com/apache/camel/commit/ec3d0db81ba061b27e934d5ff56e9baca0049eb
generic_textual CRITICAL https://github.com/apache/camel/commit/ec3d0db81ba061b27e934d5ff56e9baca0049eb
cvssv3.1 9.8 https://issues.apache.org/jira/browse/CAMEL-10894
generic_textual CRITICAL https://issues.apache.org/jira/browse/CAMEL-10894
cvssv3.1 9.8 https://issues.apache.org/jira/browse/CAMEL-12444
generic_textual CRITICAL https://issues.apache.org/jira/browse/CAMEL-12444
cvssv3.1 9.8 https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E
generic_textual CRITICAL https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E
cvssv3.1 9.8 https://lists.apache.org/thread.html/77f596fc63e63c2e9adcff3c34759b32c225cf0b582aedb755adaade@%3Cdev.camel.apache.org%3E
generic_textual CRITICAL https://lists.apache.org/thread.html/77f596fc63e63c2e9adcff3c34759b32c225cf0b582aedb755adaade@%3Cdev.camel.apache.org%3E
cvssv3.1 9.8 https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E
generic_textual CRITICAL https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2018-8027
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2018-8027
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-8027.json
https://api.first.org/data/v1/epss?cve=CVE-2018-8027
https://github.com/apache/camel
https://github.com/apache/camel/commit/22c355bb4ffb500405499d189db30932ca5aac9
https://github.com/apache/camel/commit/24eefa559fe6b310629d2bf00663d2679ec81b9
https://github.com/apache/camel/commit/2c6964ae94d8f9a9c9a32e5ae5a0b794e8b8d3b
https://github.com/apache/camel/commit/2e8f21dec883b083ddcdddd802847b4c378a61a
https://github.com/apache/camel/commit/3fe03e361725b66c1c3eaa40bb11577fb3dc17b
https://github.com/apache/camel/commit/8467d644813a62f3a836c0c7dee8cf5a41de3c0
https://github.com/apache/camel/commit/87c92b7b38890c217bc76f2c55036e6a5cca9a0
https://github.com/apache/camel/commit/8afc5d1757795fde715902067360af5d90f046d
https://github.com/apache/camel/commit/99cbcd78b7e64083fae1d9552ead7425a90994b
https://github.com/apache/camel/commit/9c6a8f61de40c20f28240fbb2af4cb425793d41
https://github.com/apache/camel/commit/9f7376abbff7434794f2c7c2909e02bac232fb5
https://github.com/apache/camel/commit/ec3d0db81ba061b27e934d5ff56e9baca0049eb
https://issues.apache.org/jira/browse/CAMEL-10894
https://issues.apache.org/jira/browse/CAMEL-12444
https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E
https://lists.apache.org/thread.html/77f596fc63e63c2e9adcff3c34759b32c225cf0b582aedb755adaade@%3Cdev.camel.apache.org%3E
https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E
http://www.securityfocus.com/bid/104933
1611632 https://bugzilla.redhat.com/show_bug.cgi?id=1611632
CVE-2018-8027 https://nvd.nist.gov/vuln/detail/CVE-2018-8027
CVE-2018-8027.TXT.ASC http://camel.apache.org/security-advisories.data/CVE-2018-8027.txt.asc
GHSA-8vfm-4388-6rpc https://github.com/advisories/GHSA-8vfm-4388-6rpc
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://camel.apache.org/security-advisories.data/CVE-2018-8027.txt.asc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-8027.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/advisories/GHSA-8vfm-4388-6rpc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/camel
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/camel/commit/22c355bb4ffb500405499d189db30932ca5aac9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/camel/commit/24eefa559fe6b310629d2bf00663d2679ec81b9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/camel/commit/2c6964ae94d8f9a9c9a32e5ae5a0b794e8b8d3b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/camel/commit/2e8f21dec883b083ddcdddd802847b4c378a61a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/camel/commit/3fe03e361725b66c1c3eaa40bb11577fb3dc17b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/camel/commit/8467d644813a62f3a836c0c7dee8cf5a41de3c0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/camel/commit/87c92b7b38890c217bc76f2c55036e6a5cca9a0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/camel/commit/8afc5d1757795fde715902067360af5d90f046d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/camel/commit/99cbcd78b7e64083fae1d9552ead7425a90994b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/camel/commit/9c6a8f61de40c20f28240fbb2af4cb425793d41
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/camel/commit/9f7376abbff7434794f2c7c2909e02bac232fb5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/camel/commit/ec3d0db81ba061b27e934d5ff56e9baca0049eb
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://issues.apache.org/jira/browse/CAMEL-10894
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://issues.apache.org/jira/browse/CAMEL-12444
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.apache.org/thread.html/77f596fc63e63c2e9adcff3c34759b32c225cf0b582aedb755adaade@%3Cdev.camel.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2018-8027
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.85356
EPSS Score 0.02526
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:38:15.358074+00:00 ProjectKB MSRImporter Import https://raw.githubusercontent.com/SAP/project-kb/master/MSR2019/dataset/vulas_db_msr2019_release.csv 38.0.0