cbcvebase.
CVE-2014-3600
published 2017-10-27

CVE-2014-3600: XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath…

PriorityP356critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
9.85%
95.0th percentile
XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

Affected

22 ranges
VendorProductVersion rangeFixed in
apacheactivemq——
apacheactivemq——
apacheactivemq——
apacheactivemq——
apacheactivemq——
apacheactivemq——
apacheactivemq——
apacheactivemq——
apacheactivemq——
apacheactivemq——
apacheactivemq——
apacheactivemq——
apacheactivemq——
apacheactivemq——
apacheactivemq——
apacheactivemq——
apacheactivemq——
apacheactivemq——
apacheactivemq>= 0 < 5.6.0+dfsg1-45.6.0+dfsg1-4
apacheactivemq>= 0 < 5.6.0+dfsg1-45.6.0+dfsg1-4
apacheactivemq>= 0 < 5.6.0+dfsg1-45.6.0+dfsg1-4
debianactivemq< activemq 5.6.0+dfsg1-4 (bookworm)activemq 5.6.0+dfsg1-4 (bookworm)

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8LOW
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.