CVE-2014-3600 — Vulnerability in...

CRITICAL

Improper Restriction of XML External Entity Reference in Apache ActiveMQ

Published May 14, 2022Updated February 21, 2024Source: osv

Summary

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

Advisory Timeline

First published May 14, 2022 (1612 days ago).
Last revised February 21, 2024 — 648 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.apache.activemq:activemq-client to 5.10.1 or later

<!-- Update pom.xml dependency version to 5.10.1 for org.apache.activemq:activemq-client -->

Maven

Update org.apache.activemq:activemq-broker to 5.10.1 or later

<!-- Update pom.xml dependency version to 5.10.1 for org.apache.activemq:activemq-broker -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: maven (2).

Package	Ecosystem	Affected	Fixed In
org.apache.activemq:activemq-client	maven	5.10.0, 5.8.0, 5.9.0, 5.9.1	5.10.1
org.apache.activemq:activemq-broker	maven	5.10.0, 5.8.0, 5.9.0, 5.9.1	5.10.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-611
XML External Entity (XXE)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2014-3600?: Improper Restriction of XML External Entity Reference in Apache ActiveMQ This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2014-3600?: CVE-2014-3600 affects org.apache.activemq:activemq-client and org.apache.activemq:activemq-broker. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2014-3600 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-4vhf-2hv7-8mrx

Related CVEs

CVE-2023-46604
CRITICAL
Apache ActiveMQ is vulnerable to Remote Code Execution
CVE-2015-5254
CRITICAL
Improper Input Validation in Apache ActiveMQ
CVE-2026-39304
HIGH
Apache ActiveMQ: Denial of Service via Out of Memory vulnerability
CVE-2026-42588
HIGH
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue
CVE-2026-41044
HIGH
Apache ActiveMQ Vulnerable to Code Injection
CVE-2026-34197
HIGH
Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans
CVE-2026-40466
HIGH
Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection
CVE-2025-27533
MEDIUM
Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies