CVE-2014-3600: XEE
Apache ActiveMQ could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection (XXE) error when processing XML data. By sending specially-crafted XML data to specify an XPath based selector, an attacker could exploit this vulnerability to obtain sensitive information.
Other sources
XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2014-3600?
CVE-2014-3600 is an XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 that allows remote consumers to obtain sensitive information.
How does CVE-2014-3600 occur?
CVE-2014-3600 occurs due to an XML External Entity Injection (XXE) error when processing XML data.
What is the severity of CVE-2014-3600?
CVE-2014-3600 has a severity rating of 9.8 (critical).
Which software versions are affected by CVE-2014-3600?
The affected software versions of CVE-2014-3600 include Apache ActiveMQ 5.0.0 to 5.10.0.
How can I fix CVE-2014-3600?
To fix CVE-2014-3600, you should upgrade to Apache ActiveMQ 5.10.1 or a later version.