GitHub Advisoryadvisory · Maven
GHSA-wmhw-hpwh-44pg Apache ActiveMQ Apollo XXE Vulnerability
CRITICAL
Official page ↗
- Aliases
- CVE-2014-3579
- Ecosystem
- Maven
- Packages
- org.apache.activemq:apollo-project
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-611
- Reviewed
- 2023-09-25
Affected packages
• Maven org.apache.activemq:apollo-project: >= 1.0.0, < 1.7.1 → fixed in 1.7.1
Description
XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
Related
Alias · CVE (1)
- CVE-2014-3579 XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via… vulnerability
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-3579 advisory
- https://github.com/apache/activemq-apollo/commit/e5647554e6801a522c508a8eb457979a9af8c398 web
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100721 web
- https://github.com/apache/activemq-apollo package
- https://issues.apache.org/jira/browse/APLO-366 web
- https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E web
- https://web.archive.org/web/20150213000202/http://seclists.org/oss-sec/2015/q1/428 web
- https://web.archive.org/web/20200228080433/http://www.securityfocus.com/bid/72508 web
- http://activemq.apache.org/security-advisories.data/CVE-2014-3579-announcement.txt web