{"id":"CVE-2020-11994","details":"Server-Side Template Injection and arbitrary file disclosure on Camel templating components","aliases":["GHSA-9vfj-5g7h-4p24"],"modified":"2026-07-08T05:53:33.838441999Z","published":"2020-07-08T16:15:11.010Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0.0"},{"last_affected":"8.5.0"}],"source":"CPE_RANGE","vendor_product":"oracle:communications_diameter_signaling_router"},{"source":"CPE_STRING","vendor_product":"oracle:enterprise_manager_base_platform","cpes":["cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"13.4.0.0"},{"last_affected":"13.4.0.0"}]},{"extracted_events":[{"introduced":"11.1.1.7.0"},{"last_affected":"11.1.1.7.0"}],"source":"CPE_STRING","vendor_product":"oracle:enterprise_repository","cpes":["cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:*"]}]},"references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuApr2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujan2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/camel","events":[{"introduced":"363777cc93ab6072cd12d2a231c2165cbc6c0524"},{"last_affected":"83cb50cde23bda73c414a6ef1240e36cbcca77b3"},{"introduced":"675a6149321065b076b5d9a4ba9dfc29a2e72a3d"},{"last_affected":"86f99c9d20bf27870784baaff76df5a80e929a13"},{"introduced":"7a239b9f57f1db4e91cf8ba601fb6917efd82d39"},{"last_affected":"d373c4c321ad45a949b568d5503e80a3cc486518"},{"introduced":"ac11f88de7594232c3c28532a19377764665ce13"},{"last_affected":"7f96e2e248cc52a8d3c5899e50bbfe71427c69d4"},{"introduced":"fa2a3c885e621014e1d54663b141b9f10b1299a4"},{"last_affected":"70be13359da5c36189f16bd84b57db44f4315edf"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*","cpe:2.3:a:apache:camel:2.25.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:camel:2.25.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.22.0"},{"last_affected":"2.22.5"},{"introduced":"2.23.0"},{"last_affected":"2.23.4"},{"introduced":"2.24.0"},{"last_affected":"2.24.3"},{"introduced":"3.0.0"},{"last_affected":"3.3.0"},{"introduced":"2.25.0"},{"last_affected":"2.25.0"},{"introduced":"2.25.1"},{"last_affected":"2.25.1"}]}}],"versions":["2.25.0","2.25.1","camel-2.24.3","camel-2.22.5","camel-2.24.0","camel-2.22.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-11994.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}