The vulnerability of the Apache ActiveMQ software platform lies in the improper limitation of XML references to external objects. This allows attackers to disclose sensitive information, cause service failures, or have other adverse effects.

🗓️ 14 Dec 2017 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

Apache ActiveMQ vulnerability: improper limit on external XML references enables data disclosure.

Reporter	Title	Published	Views	Family All 42
IBM Security Bulletins	Security Bulletin: IBM Tivoli Netcool Impact is affected by multiple vulnerabilities in IBM Tivoli Integrated Portal (TIP)	17 Jun 201815:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in ActiveMQ Affect IBM Sterling B2B Integrator	5 Feb 202000:53	–	ibm
IBM Security Bulletins	Security Bulletin: OpenSource Apache ActiveMQ vulnerabilities identified with IBM Tivoli Integrated Portal (TIP) v2.2	17 Jun 201815:50	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in Jazz for Service Management shipped with Tivoli Netcool/OMNIbus WebGUI (CVE-2014-3600)	17 Jun 201815:48	–	ibm
IBM Security Bulletins	Security Bulletin: Jazz for Service Management is affected by Open Source Apache ActiveMQ vulnerability - Reported in 02/05/2015 X-Force Report	17 Jun 201815:07	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in IBM Tivoli Integrated Portal (TIP) shipped with Tivoli Business Service Manager (CVE-2015-5254, CVE-2014-3600, CVE-2014-3612, CVE-2014-8110, CVE-2014-3579)	17 Jun 201815:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Application Performance Management	2 May 202412:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Directory Integrator is affected by multiple security vulnerabilities	22 Jun 202316:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to activemq-core (CVE-2014-3600, CVE-2013-1879, CVE-2015-6524, CVE-2011-4905)	27 Jun 202509:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities	18 Feb 201914:10	–	ibm

Vulners

Node

apache activemqRange<5.10.1

Source	Link
activemq	www.activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.txt
seclists	www.seclists.org/oss-sec/2015/q1/427
securityfocus	www.securityfocus.com/bid/72510
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/100722
issues	www.issues.apache.org/jira/browse/AMQ-5333
web	www.web.nvd.nist.gov/view/vuln/detail

23 Mar 2021 00:00Current

7.8High risk

Vulners AI Score7.8

CVSS 27.5

CVSS 39.8

EPSS0.09851

activemq vulnerability external references data disclosure service disruption crafted queries