CVE-2014-3579

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://activemq.apache.org/security-advisories.data/CVE-2014-3579-announcement.txtVendor Advisory
http://seclists.org/oss-sec/2015/q1/428Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/72508Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/100721Issue Tracking, Third Party Advisory, VDB Entry
https://issues.apache.org/jira/browse/APLO-366Issue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
http://activemq.apache.org/security-advisories.data/CVE-2014-3579-announcement.txtVendor Advisory
http://seclists.org/oss-sec/2015/q1/428Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/72508Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/100721Issue Tracking, Third Party Advisory, VDB Entry
https://issues.apache.org/jira/browse/APLO-366Issue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E

Timeline

Published: Oct 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-35805.0The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a CVE-2014-35815.0The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows re CVE-2014-35829.8In Ambari 1.2.0 through 2.2.2, it may be possible to execute arbitrary system commands on the Ambari Server host while generating SSL certif CVE-2014-35835.0The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers CVE-2014-35845.0The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of CVE-2014-35859.8redhat-upgrade-tool: Does not check GPG signatures when upgrading versions CVE-2014-35862.1The default configuration for the Command Line Interface in Red Hat Enterprise Application Platform before 6.4.0 and WildFly (formerly JBoss CVE-2014-35874.3Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.3 CVE-2014-35895.0PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a den CVE-2014-35906.5Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker CVE-2014-35914.2Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proxim CVE-2014-35926.1OpenShift Origin: Improperly validated team names could allow stored XSS attacks