CVE-2014-3579

CRITICAL

Apache ActiveMQ Apollo 1.0.0-1.7.0 - XML External Entity Injection via XPath Selector

Title source: llm
STIX 2.1

Description

XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/72508
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://seclists.org/oss-sec/2015/q1/428
Issue Tracking, Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/100721
Issue Tracking, Third Party Advisory x_refsource_confirm
https://issues.apache.org/jira/browse/APLO-366

Scores

CVSS v3 9.8
EPSS 0.0348
EPSS Percentile 87.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-611
Status published
Products (9)
apache/activemq_apollo 1.0
apache/activemq_apollo 1.1
apache/activemq_apollo 1.2
apache/activemq_apollo 1.3
apache/activemq_apollo 1.4
apache/activemq_apollo 1.5
apache/activemq_apollo 1.6
apache/activemq_apollo 1.7
org.apache.activemq/apollo-project 1.0.0 - 1.7.1Maven
Published Oct 27, 2017
Tracked Since Feb 18, 2026