CVE-2014-3600

Опубликовано: 27 окт. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

Ссылки

http://activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.txt
Vendor Advisory
http://seclists.org/oss-sec/2015/q1/427
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/72510
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/100722
Third Party Advisory
VDB Entry
https://issues.apache.org/jira/browse/AMQ-5333
Issue Tracking
Third Party Advisory
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
http://activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.txt
Vendor Advisory
http://seclists.org/oss-sec/2015/q1/427
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/72510
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/100722
Third Party Advisory
VDB Entry
https://issues.apache.org/jira/browse/AMQ-5333
Issue Tracking
Third Party Advisory
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:activemq:5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:activemq:5.3.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:activemq:5.3.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:activemq:5.3.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:activemq:5.4.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:activemq:5.4.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:activemq:5.4.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:activemq:5.4.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:activemq:5.5.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:activemq:5.5.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:activemq:5.6.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:activemq:5.7.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:activemq:5.8.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:activemq:5.9.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:activemq:5.9.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:activemq:5.10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 95%

0.09851

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-611

Связанные уязвимости

CVE-2014-3600

CVSS3: 9.8

ubuntu

почти 9 лет назад

CVE-2014-3600

redhat

больше 11 лет назад

CVE-2014-3600

CVSS3: 9.8

debian

почти 9 лет назад

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before ...

GHSA-4vhf-2hv7-8mrx

CVSS3: 9.8

github

около 4 лет назад

Improper Restriction of XML External Entity Reference in Apache ActiveMQ

BDU:2017-02578

CVSS3: 9.8

fstec

почти 9 лет назад

Уязвимость программной платформы Apache ActiveMQ, связанная с некорректным ограничением XML-ссылок на внешние объекты, позволяющая нарушителю раскрыть защищаемую информацию, вызвать отказ в обслуживании или оказать другое воздействие

EPSS

Процентиль: 95%

0.09851

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-611