What is GHSA-4vhf-2hv7-8mrx?

GHSA-4vhf-2hv7-8mrx is a security advisory published by GitHub Security Advisories with Critical severity. Improper Restriction of XML External Entity Reference in Apache ActiveMQ

Which CVE IDs does GHSA-4vhf-2hv7-8mrx cover?

GHSA-4vhf-2hv7-8mrx covers the following CVE IDs: CVE-2014-3600. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4vhf-2hv7-8mrx?

GHSA-4vhf-2hv7-8mrx has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-4vhf-2hv7-8mrx?

GHSA-4vhf-2hv7-8mrx affects 2 products, including: maven/org.apache.activemq:activemq-client:\u003e= 5.0.0, \u003c 5.10.1; maven/org.apache.activemq:activemq-broker:\u003e= 5.0.0, \u003c 5.10.1.

GHSA-4vhf-2hv7-8mrxCriticalCVSS 9.8

Improper Restriction of XML External Entity Reference in Apache ActiveMQ

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

December 20, 2023

🔗 CVE IDs covered (1)

CVE-2014-3600 →

📋 Description

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

🎯 Affected products2

maven/org.apache.activemq:activemq-client:>= 5.0.0, < 5.10.1
maven/org.apache.activemq:activemq-broker:>= 5.0.0, < 5.10.1

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2014-3600
https://exchange.xforce.ibmcloud.com/vulnerabilities/100722
https://issues.apache.org/jira/browse/AMQ-5333
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E
http://activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.txt
http://seclists.org/oss-sec/2015/q1/427
https://github.com/apache/activemq/commit/3e5ac6326db59f524a0e71f6b717428607d7b67d
https://github.com/advisories/GHSA-4vhf-2hv7-8mrx