CVE-2014-3600

high-risk
Published 2017-10-27

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

Do I need to act?

-
0.51% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (18)

Affected Vendors

Apache

References (12)

Vendor Advisory http://activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.t...
Mailing List http://seclists.org/oss-sec/2015/q1/427
Third Party Advisory http://www.securityfocus.com/bid/72510
Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/100722
Issue Tracking https://issues.apache.org/jira/browse/AMQ-5333
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65...
Vendor Advisory http://activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.t...
Mailing List http://seclists.org/oss-sec/2015/q1/427
Third Party Advisory http://www.securityfocus.com/bid/72510
Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/100722
Issue Tracking https://issues.apache.org/jira/browse/AMQ-5333
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65...
53
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 2/34 · Minimal
Exposure 19/34 · Moderate