Description

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

Remediation

References

https://issues.apache.org/jira/browse/AMQ-5333

https://exchange.xforce.ibmcloud.com/vulnerabilities/100722

http://www.securityfocus.com/bid/72510

http://seclists.org/oss-sec/2015/q1/427

http://activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.txt

https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E

Related Vulnerabilities

CVE-2018-10862 Vulnerability in maven package org.wildfly.core:wildfly-deployment-repository

CVE-2019-16869 Vulnerability in maven package io.netty:netty-all

CVE-2019-10776 Vulnerability in npm package git-diff-apply

CVE-2022-1295 Vulnerability in npm package fullpage.js

CVE-2023-26127 Vulnerability in npm package n158

Severity

Critical

Classification

CWE-611 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Issue Tracking Third Party Advisory VDB Entry Mailing List Vendor Advisory