Vulnerability in Apache Camel
CVE-2020-11971
Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.140 (96.5th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 96.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.140 · newest: 0.140 · change: 0.000
Affected products
- Apache Camel
- Oracle Communications Diameter Intelligence Hub
- Oracle Communications Diameter Signaling Router
- Oracle Enterprise Manager Base Platform — versions 13.3.0.0, 13.4.0.0
- Oracle Flexcube Private Banking — versions 12.0.0, 12.1.0
- Apache Camel — versions Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0
References
- www.openwall.com/lists/oss-security/2020/05/14/7 (mailing-list, Patch, Mailing List, Third Party Advisory)
- lists.apache.org/thread.html/r7968b5086e861da2cf635a7b215e465ce9912d5f16c683b8e… (mailing-list)
- lists.apache.org/thread.html/r16f4f9019840bc923e25d1b029fb42fe2676c4ba36e548247… (mailing-list)
- lists.apache.org/thread.html/r3d0ae14ca224e69fb1c653f0a5d9e56370ee12d8896aa4490… (mailing-list)
- lists.apache.org/thread.html/r45da6abb42a9e6853ec8affdbf591f1db3e90c5288de9d375… (mailing-list)
- lists.apache.org/thread.html/rb0033c4e9dade1fdf22493314062364ff477e9a8b417f687d… (mailing-list)
- lists.apache.org/thread.html/r8988311eb2481fd8a87e69cf17ffb8dc81bfeba5503021537… (mailing-list)
- www.oracle.com/security-alerts/cpuoct2020.html (Third Party Advisory)
- camel.apache.org/security/CVE-2020-11971.html (Patch, Vendor Advisory)
- lists.apache.org/thread.html/r938dc2ded68039ab747f6d7a12153862495d4b38107d3ed11… (mailing-list)
Frequently asked questions
- What is CVE-2020-11971?
- CVE-2020-11971 is a high-severity vulnerability in Apache Camel. CVSS score: 7.5/10. Published 2020-05-14.
- How severe is CVE-2020-11971?
- High severity. CVSS v3 base score is 7.5 out of 10.