Description
XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
Remediation
References
http://activemq.apache.org/security-advisories.data/CVE-2014-3579-announcement.txt
http://seclists.org/oss-sec/2015/q1/428
http://www.securityfocus.com/bid/72508
https://exchange.xforce.ibmcloud.com/vulnerabilities/100721
https://issues.apache.org/jira/browse/APLO-366
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
Related Vulnerabilities
CVE-2018-11537 Vulnerability in maven package org.webjars:angular-jwt
CVE-2022-22984 Vulnerability in npm package snyk-mvn-plugin
CVE-2022-28220 Vulnerability in maven package org.apache.james.protocols:protocols-netty
CVE-2023-2585 Vulnerability in maven package org.keycloak:keycloak-server-spi-private
CVE-2021-37306 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-base