QwikSec

Security Database

CVE

CWE

Training

CVE-2015-5348

Published: Apr 15, 2016

Modified: Aug 6, 2024

PUBLISHED

Description

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

http://packetstormsecurity.com/files/134946/Apache-Camel-Java-Object-Deserialization.html

x_refsource_MISC

vendor-advisory

x_refsource_REDHAT

http://camel.apache.org/security-advisories.data/CVE-2015-5348.txt.asc

x_refsource_CONFIRM

https://issues.apache.org/jira/browse/CAMEL-9309

x_refsource_CONFIRM

20151217 CVE-2015-5348 - Apache Camel medium disclosure vulnerability

mailing-list

x_refsource_BUGTRAQ

vdb-entry

x_refsource_BID

[camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html

mailing-list

x_refsource_MLIST

[camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.