GitHub Advisoryadvisory · Maven

GHSA-4vhf-2hv7-8mrx Improper Restriction of XML External Entity Reference in Apache ActiveMQ

CRITICAL Published 2022-05-14 Modified 2023-12-20 Official page ↗
Aliases
CVE-2014-3600
Ecosystem
Maven
Packages
org.apache.activemq:activemq-client, org.apache.activemq:activemq-broker
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2022-07-07

Affected packages

• Maven org.apache.activemq:activemq-client: >= 5.0.0, < 5.10.1 → fixed in 5.10.1 • Maven org.apache.activemq:activemq-broker: >= 5.0.0, < 5.10.1 → fixed in 5.10.1

Description

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

Related

Alias · CVE (1)

  • CVE-2014-3600 XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References