CVE-2014-3600 Improper Restriction of XML External Entity Reference in Apache ActiveMQ
CriticalCVSS 9.8
EPSS 8.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.activemq/activemq-client(Maven) | >= 5.0.0, < 5.10.1 | 5.10.1 |
| org.apache.activemq/activemq-broker(Maven) | >= 5.0.0, < 5.10.1 | 5.10.1 |
| org.apache.activemq/activemq-client(Maven) | = 5.10.0 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.8.0 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.9.0 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.9.1 | No fix listed |
| org.apache.activemq/activemq-broker(Maven) | = 5.10.0 | No fix listed |
| org.apache.activemq/activemq-broker(Maven) | = 5.8.0 | No fix listed |
| org.apache.activemq/activemq-broker(Maven) | = 5.9.0 | No fix listed |
| org.apache.activemq/activemq-broker(Maven) | = 5.9.1 | No fix listed |
| debian/activemq(Debian:12) | < 5.6.0+dfsg1-4 | 5.6.0+dfsg1-4 |
| debian/activemq(Debian:13) | < 5.6.0+dfsg1-4 | 5.6.0+dfsg1-4 |
| apache activemq | = 5.0.0 | No fix listed |
| apache activemq | = 5.1.0 | No fix listed |
| apache activemq | = 5.2.0 | No fix listed |
| apache activemq | = 5.3.0 | No fix listed |
| apache activemq | = 5.3.1 | No fix listed |
| apache activemq | = 5.3.2 | No fix listed |
| apache activemq | = 5.4.0 | No fix listed |
| apache activemq | = 5.4.1 | No fix listed |
| apache activemq | = 5.4.2 | No fix listed |
| apache activemq | = 5.4.3 | No fix listed |
| apache activemq | = 5.5.0 | No fix listed |
| apache activemq | = 5.5.1 | No fix listed |
| apache activemq | = 5.6.0 | No fix listed |
Show 5 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache activemq | = 5.7.0 | No fix listed |
| apache activemq | = 5.8.0 | No fix listed |
| apache activemq | = 5.9.0 | No fix listed |
| apache activemq | = 5.9.1 | No fix listed |
| apache activemq | = 5.10.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- apache-activemq-cve20143600-info-disc(100722) third-party-advisory vdb-entry
- issues.apache.org issue-tracking third-party-advisory
- lists.apache.org
- activemq.apache.org vendor-advisory
- [oss-security] 20150205 [ANNOUNCE] CVE-2014-3600, CVE-2014-3612 and CVE-2014-8110 - Apache ActiveMQ vulnerabilities mailing-list third-party-advisory
- github.com patch
- github.com
- github.com
- Debian Security Tracker CVE-2014-3600 vendor-advisory
- 72510 third-party-advisory vdb-entry
- [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/ mailing-list
- bugs.debian.org issue-tracking