Description
XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
Remediation
References
http://activemq.apache.org/security-advisories.data/CVE-2014-3579-announcement.txt
http://seclists.org/oss-sec/2015/q1/428
http://www.securityfocus.com/bid/72508
https://exchange.xforce.ibmcloud.com/vulnerabilities/100721
https://issues.apache.org/jira/browse/APLO-366
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
Related Vulnerabilities
CVE-2020-1957 Vulnerability in maven package org.apache.shiro:shiro-web
CVE-2022-25872 Vulnerability in npm package fast-string-search
CVE-2022-42124 Vulnerability in maven package com.liferay:com.liferay.layout.page.template.service
CVE-2021-42392 Vulnerability in maven package com.h2database:h2
CVE-2020-2212 Vulnerability in maven package org.jenkins-ci.plugins:github-coverage-reporter