Server-Side Request Forgery (SSRF) in Apache Camel - CVE-2017-5643

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU111924

Server-Side Request Forgery (SSRF) in Apache Camel - CVE-2017-5643

Published: June 25, 2025


Vulnerability identifier: #VU111924
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-5643
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to validation Component of Apache Camel evaluates DTD headers of XML stream sources, although a validation against XML schemas (XSD) is executed. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.


Affected software

Apache Camel
Jazz for Service Management

How to mitigate CVE-2017-5643

Install updates from vendor's website.

Apache Camel - addressed in versions 2.17.6, 2.18.3
Jazz for Service Management - update to 1.1.3.25

External References

Related Security Bulletins