CVE-2014-0003

CVE-2014-0003 is a high-severity vulnerability in Apache Camel with a CVSS 2.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-264.

Key facts

• Severity: High (CVSS 2.0 base score 7.5)
• EPSS exploit prediction: 7% (94th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-264
• Affected product: Apache Camel
• Published: 2014-03-21
• Last modified: 2026-06-17

Description

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.

Frequently asked questions

What is CVE-2014-0003?

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.

How severe is CVE-2014-0003?

CVE-2014-0003 has a CVSS 2.0 base score of 7.5, rated high severity.

Is CVE-2014-0003 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 7% (94th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2014-0003?

CVE-2014-0003 primarily affects Apache Camel. In total, 31 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2014-0003?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2014-0003 published?

CVE-2014-0003 was published on 2014-03-21 and last updated on 2026-06-17.

References

• http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc
• http://rhn.redhat.com/errata/RHSA-2014-0245.html
• http://rhn.redhat.com/errata/RHSA-2014-0254.html
• http://rhn.redhat.com/errata/RHSA-2014-0371.html
• http://rhn.redhat.com/errata/RHSA-2014-0372.html
• http://secunia.com/advisories/57125
• http://secunia.com/advisories/57716
• http://secunia.com/advisories/57719
• http://www.securityfocus.com/bid/65902
• https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E
• https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E

Affected products (31)

• cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:1.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:1.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:1.3.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:1.5.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:1.6.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:1.6.1:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:1.6.2:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:1.6.3:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:1.6.4:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.0.0:milestone1:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.0.0:milestone2:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.0.0:milestone3:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.10.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.10.1:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.10.2:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.10.3:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.10.4:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.10.5:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.10.6:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.10.7:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.11.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.11.1:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.11.2:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.12.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.12.1:*:*:*:*:*:*:*
• cpe:2.3:a:apache:camel:2.12.2:*:*:*:*:*:*:*

More vulnerabilities in Apache Camel

• CVE-2026-33453 — Critical (CVSS 10.0): Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap…
• CVE-2026-40453 — Critical (CVSS 9.9): The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such…
• CVE-2026-48204 — Critical (CVSS 9.8): Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs…
• CVE-2026-46456 — Critical (CVSS 9.8): Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound…
• CVE-2026-46455 — Critical (CVSS 9.8): Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper…
• CVE-2026-46454 — Critical (CVSS 9.8): Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound…

All CVEs affecting Apache Camel →

Other CWE-264 (Permissions, Privileges, and Access Controls) vulnerabilities

• CVE-2016-8363 — Critical (CVSS 10.0): An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232…
• CVE-2016-7457 — Critical (CVSS 10.0): VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to gain privileges, or halt…
• CVE-2015-7425 — Critical (CVSS 10.0): The Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual Environments: Data…
• CVE-2015-8267 — Critical (CVSS 10.0): The PasswordReset.Controllers.ResetController.ChangePasswordIndex method in PasswordReset.dll in Dovestones AD Self…
• CVE-2015-7919 — Critical (CVSS 10.0): SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of…
• CVE-2015-7071 — Critical (CVSS 10.0): The File Bookmark component in Apple OS X before 10.11.2 allows attackers to bypass a sandbox protection mechanism for…

Browse all CWE-264 (Permissions, Privileges, and Access Controls) vulnerabilities →