What’s Vulnerable › Vulnerabilities

CVE-2020-11994

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-07-08 · updated 2026-06-17
• Weakness: CWE-74

Description

Server-Side Template Injection and arbitrary file disclosure on Camel templating components

Affected products

• Apache Software Foundation Apache Camel: from 2.22.0 through 2.22.5; from 2.23.0 through 2.23.4; from 2.24.0 through 2.24.3; from 3.0.0 through 3.3.0; 2.25.0, 2.25.1
• Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0 through 8.5.0
• Oracle Corporation Enterprise Manager Base Platform: 13.4.0.0
• Oracle Corporation Enterprise Repository: 11.1.1.7.0

References

• https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://www.oracle.com/security-alerts/cpuoct2021.html

Get alerted when CVE-2020-11994 or the next vulnerability affects your stack