Vulnerabilities > CVE-2014-3579 - XXE vulnerability in Apache Activemq Apollo

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

apache

CWE-611

critical

NVD

Published: 2017-10-27

Updated: 2024-11-21

Summary

XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Activemq Apollo 1.7 Apache Activemq Apollo 1.6 Apache Activemq Apollo 1.5 Apache Activemq Apollo 1.4 Apache Activemq Apollo 1.3 Apache Activemq Apollo 1.2 Apache Activemq Apollo 1.1 Apache Activemq Apollo 1.0	8

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

References

http://activemq.apache.org/security-advisories.data/CVE-2014-3579-announcement.txt
http://activemq.apache.org/security-advisories.data/CVE-2014-3579-announcement.txt
http://seclists.org/oss-sec/2015/q1/428
http://seclists.org/oss-sec/2015/q1/428
http://www.securityfocus.com/bid/72508
http://www.securityfocus.com/bid/72508
https://exchange.xforce.ibmcloud.com/vulnerabilities/100721
https://exchange.xforce.ibmcloud.com/vulnerabilities/100721
https://issues.apache.org/jira/browse/APLO-366
https://issues.apache.org/jira/browse/APLO-366
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E