GHSA-4vhf-2hv7-8mrx

Suggest an improvement
Source
https://github.com/advisories/GHSA-4vhf-2hv7-8mrx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-4vhf-2hv7-8mrx/GHSA-4vhf-2hv7-8mrx.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-4vhf-2hv7-8mrx
Aliases
Published
2022-05-14T01:14:52Z
Modified
2024-02-21T05:41:13.978050Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Improper Restriction of XML External Entity Reference in Apache ActiveMQ
Details

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

Database specific
{
    "nvd_published_at": "2017-10-27T19:29:00Z",
    "cwe_ids": [
        "CWE-611"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-07T22:38:48Z"
}
References

Affected packages

Maven / org.apache.activemq:activemq-client

Package

Name
org.apache.activemq:activemq-client
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0.0
Fixed
5.10.1

Affected versions

5.*

5.8.0
5.9.0
5.9.1
5.10.0

Maven / org.apache.activemq:activemq-broker

Package

Name
org.apache.activemq:activemq-broker
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-broker

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0.0
Fixed
5.10.1

Affected versions

5.*

5.8.0
5.9.0
5.9.1
5.10.0