What is CVE-2015-5348?

CVE-2015-5348 is a high-severity vulnerability in Apache Camel, classified under CWE-19. CVSS score: 8.1/10. Published 2016-04-15.

How severe is CVE-2015-5348?

High severity. CVSS v3 base score is 8.1 out of 10.

Is CVE-2015-5348 known to be exploited?

8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Apache Camel

CVE-2015-5348

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized…

EPSS: 0.068 (91.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Apache Camel — versions 2.6.0, 2.7.0, 2.7.1
N/a — versions n/a

Weakness classification (CWE)

CWE-19

Public proof-of-concept exploits

References

secalert@redhat.com (x_refsource_MISC)
RHSA-2016:2035 (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
20151217 CVE-2015-5348 - Apache Camel medium disclosure vulnerability (mailing-list, x_refsource_BUGTRAQ)
80696 (vdb-entry, x_refsource_BID)
[camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html (mailing-list, x_refsource_MLIST)
[camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html (mailing-list, x_refsource_MLIST)

Frequently asked questions

What is CVE-2015-5348?: CVE-2015-5348 is a high-severity vulnerability in Apache Camel, classified under CWE-19. CVSS score: 8.1/10. Published 2016-04-15.
How severe is CVE-2015-5348?: High severity. CVSS v3 base score is 8.1 out of 10.
Is CVE-2015-5348 known to be exploited?: 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.