CVE-2014-3600: Apache ActiveMQ XML External Entity Reference Vulnerability
Summary
CVE-2014-3600: Improper Restriction of XML External Entity Reference in Apache ActiveMQ. Affects org.apache.activemq:activemq-client versions >= 5.0.0, < 5.10.1. Fixed in 5.10.1. How to fix ↓
Also tracked for
- activemq · Debian:11
The same CVE-2014-3600 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache ActiveMQ is an open-source message broker written in Java that provides messaging services for distributed applications. It allows applications to communicate with each other by exchanging messages. The 'org.apache.activemq:activemq-client' package is a client library for Apache ActiveMQ that enables applications to interact with the message broker. This package is widely used in various Java-based applications.
Vulnerability Detail
The Apache ActiveMQ 5.x version before 5.10.1 is vulnerable to an XML external entity (XXE) attack. This vulnerability allows remote consumers to exploit the message queuing system's XPath-based selector, leading to unspecified impacts. By sending specially crafted XML messages, an attacker can trigger the XXE vulnerability and potentially gain unauthorized access, execute arbitrary code, or perform other malicious activities.
How To Fix
Minimum fixed version
5.10.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to Apache ActiveMQ version 5.10.1 or later.
Conclusion
The Apache ActiveMQ XML External Entity Reference Vulnerability (CVE-2014-3600) poses a significant risk to applications utilizing the Apache ActiveMQ message broker. It is crucial to upgrade to Apache ActiveMQ version 5.10.1 or later to mitigate this vulnerability. Failure to address this issue may result in unauthorized access, code execution, and other malicious activities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.activemq:activemq-client →
FAQ
Apache ActiveMQ is an open-source message broker written in Java that provides messaging services for distributed applications.
The impacted package is 'org.apache.activemq:activemq-client', which is a client library for Apache ActiveMQ.
An XML external entity (XXE) vulnerability is a type of attack that exploits the processing of XML data by an application. It allows an attacker to include external entities or files, leading to unauthorized access, data disclosure, or remote code execution.
The potential impacts of this vulnerability include unauthorized access to sensitive information, remote code execution, and other malicious activities.
To fix this vulnerability, upgrade to Apache ActiveMQ version 5.10.1 or later by updating the 'org.apache.activemq:activemq-client' package.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:activemq-client.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
