Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2014-3600

Опубликовано: 05 фев. 2015
Источник: redhat
CVSS2: 5
EPSS Низкий

Описание

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

It was discovered that Apache ActiveMQ performed XML External Entity (XXE) expansion when evaluating XPath expressions. A remote, attacker-controlled consumer able to specify an XPath-based selector to dequeue XML messages from an Apache ActiveMQ broker could use this flaw to read files accessible to the user running the broker, and potentially perform other more advanced XXE attacks.

Отчет

Fuse ESB 4 and Fuse Message Broker 5.2, 5.3, 5.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/ Fuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/ Red Hat JBoss SOA Platform 4 is now in Phase 3, Extended Life Support, of its respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ Red Hat OpenShift Enterprise 1 and 2 are now in Production 1 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat OpenShift Enterprise Life Cycle: https://access.redhat.com/site/support/policy/updates/openshift/

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
OpenShift Enterprise 1activemqWill not fix
Red Hat JBoss SOA Platform 4activemqWill not fix
Red Hat OpenShift Enterprise 2activemqWill not fix
Fuse ESB Enterprise 7.1.0FixedRHSA-2015:013805.02.2015
Fuse Management Console 7.1.0FixedRHSA-2015:013805.02.2015
Fuse MQ Enterprise 7.1.0FixedRHSA-2015:013805.02.2015
Red Hat JBoss A-MQ 6.1FixedRHSA-2015:013705.02.2015
Red Hat JBoss Fuse 6.1FixedRHSA-2015:013705.02.2015

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-611
https://bugzilla.redhat.com/show_bug.cgi?id=1133649ActiveMQ: XXE via XPath expression evaluation

EPSS

Процентиль: 95%
0.09972
Низкий

5 Medium

CVSS2

Связанные уязвимости

CVSS3: 9.8
ubuntu
почти 9 лет назад

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

CVSS3: 9.8
nvd
почти 9 лет назад

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

CVSS3: 9.8
debian
почти 9 лет назад

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before ...

CVSS3: 9.8
github
около 4 лет назад

Improper Restriction of XML External Entity Reference in Apache ActiveMQ

CVSS3: 9.8
fstec
почти 9 лет назад

Уязвимость программной платформы Apache ActiveMQ, связанная с некорректным ограничением XML-ссылок на внешние объекты, позволяющая нарушителю раскрыть защищаемую информацию, вызвать отказ в обслуживании или оказать другое воздействие

EPSS

Процентиль: 95%
0.09972
Низкий

5 Medium

CVSS2