CVE-2017-5643

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.

Metrics

CVSS 3.0 7.4/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
Apache Software FoundationApache Camel2.17.0 to 2.17.5; 2.18.0 to 2.18.2; The unsupported Camel 2.x (2.16 and earlier) versions may be also affected.

References

Timeline

Published
Mar 16, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-56445.5Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted CVE-2017-56459.8In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another applicCVE-2017-56466.8For versions of Apache Knox from 0.2.0 to 0.11.0 - an authenticated user may use a specially crafted URL to impersonate another user while aCVE-2017-56477.5A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.7CVE-2017-56489.1While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.CVE-2017-56497.5Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users wCVE-2017-56507.5In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams asCVE-2017-56519.8In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file CVE-2017-56527.5During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext eCVE-2017-56535.3JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encryptCVE-2017-56547.5In Ambari 2.4.x (before 2.4.3) and Ambari 2.5.0, an authorized user of the Ambari Hive View may be able to gain unauthorized read access to CVE-2017-56556.5In Ambari 2.2.2 through 2.4.2 and Ambari 2.5.0, sensitive data may be stored on disk in temporary files on the Ambari Server host. The tempo
CVE-2017-5643: High severity, CVSS 7.4 | Vulnix