CVE-2014-3600

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

Score

CVSS 3.0 9.8 Critical

Status

Modified - secalert@redhat.com

Published

2017-10-27

Last modified

2024-08-06

Weaknesses

CWE-611

Affected products

• Activemq (Apache)

References

• http://activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.txt
• http://seclists.org/oss-sec/2015/q1/427
• http://www.securityfocus.com/bid/72510
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100722
• https://issues.apache.org/jira/browse/AMQ-5333
• https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apa…