CVE-2014-3600
CRITICALApache ActiveMQ 5.x < 5.10.1 - XML External Entity Injection via XPath Selector
Title source: llmDescription
XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
References (6)
Core 6
Core References
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://seclists.org/oss-sec/2015/q1/427
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/72510
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/100722
Vendor Advisory x_refsource_confirm
http://activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.txt
Issue Tracking, Third Party Advisory x_refsource_confirm
https://issues.apache.org/jira/browse/AMQ-5333
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
Scores
CVSS v3
9.8
EPSS
0.0051
EPSS Percentile
66.7%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-611
Status
published
Products (20)
apache/activemq
5.0.0
apache/activemq
5.1.0
apache/activemq
5.2.0
apache/activemq
5.3.0
apache/activemq
5.3.1
apache/activemq
5.3.2
apache/activemq
5.4.0
apache/activemq
5.4.1
apache/activemq
5.4.2
apache/activemq
5.4.3
... and 10 more
Published
Oct 27, 2017
Tracked Since
Feb 18, 2026