01 Record

CVE-2014-3600

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML

UnratedPUBLISHEDCNA: redhat

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 9.97% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 95.3% of scored records. A rank, not a probability.
NVD base score: 9.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2017-10-27 19:00Z8 YR AGO

Last updated

2024-08-06 10:50Z2 YR AGO

Reserved

2014-05-14

Assigning CNA

redhat

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-611Improper Restriction of XML External Entity ReferenceBase

Data version

5.1

Document digest

64f7fc9719a18c18c8ead2b1c3a4ef77963e1f965e637444032e2819b4700e9d

05 Affected products

VendorProductVersionsPlatforms

apacheactivemqNot specified—

redhatfuse_esb_enterpriseNot specified—

redhatfuse_management_consoleNot specified—

redhatfuse_mq_enterpriseNot specified—

redhatjboss_amqNot specified—

redhatjboss_enterprise_soa_platformNot specified—

redhatjboss_fuseNot specified—

redhatopenshiftNot specified—

06 References

seclists.org[oss-security] 20150205 [ANNOUNCE] CVE-2014-3600, CVE-2014-3612 and CVE-2014-8110 - Apache ActiveMQ vulnerabilitieshttp://seclists.org/oss-sec/2015/q1/427mailing-listx_refsource_MLIST
www.securityfocus.com72510http://www.securityfocus.com/bid/72510vdb-entryx_refsource_BID
exchange.xforce.ibmcloud.comapache-activemq-cve20143600-info-disc(100722)https://exchange.xforce.ibmcloud.com/vulnerabilities/100722vdb-entryx_refsource_XF
activemq.apache.orghttp://activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.txtx_refsource_CONFIRM
issues.apache.orghttps://issues.apache.org/jira/browse/AMQ-5333x_refsource_CONFIRM
lists.apache.org[activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3Emailing-listx_refsource_MLIST

01 Record index

CVE-2014-3600

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2014-3600

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References