GHSA-x9fv-c87w-55wc

Source

https://github.com/advisories/GHSA-x9fv-c87w-55wc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-x9fv-c87w-55wc/GHSA-x9fv-c87w-55wc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-x9fv-c87w-55wc

Aliases

CVE-2013-4330

Published

2022-05-13T01:26:34Z

Modified

2024-12-06T05:39:49.459830Z

Summary

Improper Control of Generation of Code in Apache Camel

Details

Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileName message header to a (1) FILE or (2) FTP producer.

Database specific

{
    "nvd_published_at": "2013-10-04T17:55:00Z",
    "cwe_ids": [
        "CWE-94"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-08T19:19:37Z"
}

References

Affected packages

Maven / org.apache.camel:camel-core

Package

Name: org.apache.camel:camel-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.camel/camel-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.9.7

Affected versions

1.*

1.0.0

1.1.0

1.2.0

1.3.0

1.4.0

1.5.0

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

2.*

2.0-M1

2.0-M2

2.0-M3

2.0.0

2.1.0

2.2.0

2.3.0

2.4.0

2.5.0

2.6.0

2.7.0

2.7.1

2.7.2

2.7.3

2.7.4

2.7.5

2.8.0

2.8.1

2.8.2

2.8.3

2.8.4

2.8.5

2.8.6

2.9.0-RC1

2.9.0

2.9.1

2.9.2

2.9.3

2.9.4

2.9.5

2.9.6

Maven / org.apache.camel:camel-core

Package

Name: org.apache.camel:camel-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.camel/camel-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.10.0

Fixed

2.10.7

Affected versions

2.*

2.10.0

2.10.1

2.10.2

2.10.3

2.10.4

2.10.5

2.10.6

Maven / org.apache.camel:camel-core

Package

Name: org.apache.camel:camel-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.camel/camel-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.11.0

Fixed

2.11.2

Affected versions

2.*

2.11.0

2.11.1

Maven / org.apache.camel:camel-core

Package

Name: org.apache.camel:camel-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.camel/camel-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.12.0

Fixed

2.12.1

Affected versions

2.*

2.12.0