{"id":"CVE-2014-3600","published":"2017-10-27T19:00:00Z","modified":"2024-08-06T10:50:17Z","title":"XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have…","vendor":null,"product":null,"tier":"tail","description":{"text":"XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.08181,"percentile":0.94845,"provenance":"source"},"cwes":[],"references":[{"url":"http://seclists.org/oss-sec/2015/q1/427","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.securityfocus.com/bid/72510","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100722","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.txt","tags":["x_refsource_CONFIRM"]},{"url":"https://issues.apache.org/jira/browse/AMQ-5333","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":19.0,"factors":[{"name":"EPSS percentile","points":18.97}]},"affected":[{"ecosystem":"Maven","package":"org.apache.activemq:activemq-client","vulnerableRanges":[">=5.0.0, <5.10.1"],"patched":["5.10.1"],"from":["GHSA-4vhf-2hv7-8mrx"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.activemq:activemq-broker","vulnerableRanges":[">=5.0.0, <5.10.1"],"patched":["5.10.1"],"from":["GHSA-4vhf-2hv7-8mrx"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2450","exploited":false,"provenance":"source"}}