GHSA-4vhf-2hv7-8mrx
Improper Restriction of XML External Entity Reference in Apache ActiveMQ
At a glance
- Published
- Updated
- CVE
- CVE-2014-3600
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.activemq:activemq-client | introduced 5.0.0, fixed 5.10.1 |
| Maven · org.apache.activemq:activemq-broker | introduced 5.0.0, fixed 5.10.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-3600 ADVISORY
- https://github.com/apache/activemq/commit/3e5ac6326db59f524a0e71f6b717428607d7b67d WEB
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100722 WEB
- https://github.com/apache/activemq WEB
- https://issues.apache.org/jira/browse/AMQ-5333 WEB
- https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E WEB
- http://activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.txt WEB
- http://seclists.org/oss-sec/2015/q1/427 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |