Improper Restriction of XML External Entity Reference in Apache ActiveMQ

2022-05-1402:21:03

CWE-611

GitHub Advisory Database

github.com

xml external entity

xxe vulnerability

xpath selector

artemis activemq

remote attackers

JSON

XML external entity (XXE) vulnerability in the XPath selector component in Artemis ActiveMQ before commit 48d9951d879e0c8cbb59d4b64ab59d53ef88310d allows remote attackers to have unspecified impact via unknown vectors.

Affected configurations

Vulners

Node

org.apache.activemqactivemq-clientRange≤2.23.0

VendorProductVersionCPE
org.apache.activemqactivemq-client*cpe:2.3:a:org.apache.activemq:activemq-client:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
org.apache.activemq	activemq-client	*	cpe:2.3:a:org.apache.activemq:activemq-client::::::::

References

www.openwall.com/lists/oss-security/2015/07/24/2

access.redhat.com/errata/RHSA-2018:2927

bugzilla.redhat.com/show_bug.cgi?id=1225252

github.com/advisories/GHSA-x6rc-54xp-ccxx

github.com/apache/activemq-artemis/commit/48d9951d879e0c8cbb59d4b64ab59d53ef88310d

nvd.nist.gov/vuln/detail/CVE-2015-3208

JSON

Related for GHSA-X6RC-54XP-CCXX