GHSA-4vhf-2hv7-8mrx

Source

https://github.com/advisories/GHSA-4vhf-2hv7-8mrx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-4vhf-2hv7-8mrx/GHSA-4vhf-2hv7-8mrx.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-4vhf-2hv7-8mrx

Aliases

CVE-2014-3600

Published

2022-05-14T01:14:52Z

Modified

2024-02-21T05:41:13.978050Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Improper Restriction of XML External Entity Reference in Apache ActiveMQ

Details

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

Database specific

{
    "nvd_published_at": "2017-10-27T19:29:00Z",
    "cwe_ids": [
        "CWE-611"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-07T22:38:48Z"
}

References

Affected packages

Maven / org.apache.activemq:activemq-client

Package

Name: org.apache.activemq:activemq-client; View open source insights on deps.dev
Purl: pkg:maven/org.apache.activemq/activemq-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0.0

Fixed

5.10.1

Affected versions

5.*

5.8.0

5.9.0

5.9.1

5.10.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-4vhf-2hv7-8mrx/GHSA-4vhf-2hv7-8mrx.json"

Maven / org.apache.activemq:activemq-broker