Read the docs
TI-2014-02923 Aliases CVE-2014-3600GHSA-4vhf-2hv7-8mrx

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows…

Priority MEDIUM 53CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 5 fixed, 3 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

Why it matters now

EPSS 0.08181 94th percentileScored 2026-11-07
Fix Partial org.apache.activemq:activemq-client (Maven): 5.10.1org.apache.activemq:activemq-broker (Maven): 5.10.1Red Hat: 2 advisoriesRed Hat: 5 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.activemq:activemq-client (Maven)5.0.0 to before 5.10.15.10.1Patch availableGHSA-4vhf-2hv7-8mrx
—org.apache.activemq:activemq-broker (Maven)5.0.0 to before 5.10.15.10.1Patch availableGHSA-4vhf-2hv7-8mrx
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.activemq:activemq-client (Maven) Vendor— Affected 5.0.0 to before 5.10.1 Fixed in 5.10.1 Patch available GHSA-4vhf-2hv7-8mrx
  • org.apache.activemq:activemq-broker (Maven) Vendor— Affected 5.0.0 to before 5.10.1 Fixed in 5.10.1 Patch available GHSA-4vhf-2hv7-8mrx

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:apache:activemq:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableApache
cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:*5.1.0VulnerableApache
cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:*5.2.0VulnerableApache
cpe:2.3:a:apache:activemq:5.3.0:*:*:*:*:*:*:*5.3.0VulnerableApache
cpe:2.3:a:apache:activemq:5.3.1:*:*:*:*:*:*:*5.3.1VulnerableApache
cpe:2.3:a:apache:activemq:5.3.2:*:*:*:*:*:*:*5.3.2VulnerableApache
cpe:2.3:a:apache:activemq:5.4.0:*:*:*:*:*:*:*5.4.0VulnerableApache
cpe:2.3:a:apache:activemq:5.4.1:*:*:*:*:*:*:*5.4.1VulnerableApache
cpe:2.3:a:apache:activemq:5.4.2:*:*:*:*:*:*:*5.4.2VulnerableApache
cpe:2.3:a:apache:activemq:5.4.3:*:*:*:*:*:*:*5.4.3VulnerableApache
  • cpe:2.3:a:apache:activemq:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:* Versions 5.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.3.0:*:*:*:*:*:*:* Versions 5.3.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.3.1:*:*:*:*:*:*:* Versions 5.3.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.3.2:*:*:*:*:*:*:* Versions 5.3.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.4.0:*:*:*:*:*:*:* Versions 5.4.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.4.1:*:*:*:*:*:*:* Versions 5.4.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.4.2:*:*:*:*:*:*:* Versions 5.4.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.4.3:*:*:*:*:*:*:* Versions 5.4.3 Vulnerable ·Apache
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:activemq:5.5.0:*:*:*:*:*:*:*5.5.0VulnerableApache
cpe:2.3:a:apache:activemq:5.5.1:*:*:*:*:*:*:*5.5.1VulnerableApache
cpe:2.3:a:apache:activemq:5.6.0:*:*:*:*:*:*:*5.6.0VulnerableApache
cpe:2.3:a:apache:activemq:5.7.0:*:*:*:*:*:*:*5.7.0VulnerableApache
cpe:2.3:a:apache:activemq:5.8.0:*:*:*:*:*:*:*5.8.0VulnerableApache
cpe:2.3:a:apache:activemq:5.9.0:*:*:*:*:*:*:*5.9.0VulnerableApache
cpe:2.3:a:apache:activemq:5.9.1:*:*:*:*:*:*:*5.9.1VulnerableApache
cpe:2.3:a:apache:activemq:5.10.0:*:*:*:*:*:*:*5.10.0VulnerableApache
  • cpe:2.3:a:apache:activemq:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.5.1:*:*:*:*:*:*:* Versions 5.5.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.6.0:*:*:*:*:*:*:* Versions 5.6.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.7.0:*:*:*:*:*:*:* Versions 5.7.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.8.0:*:*:*:*:*:*:* Versions 5.8.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.9.0:*:*:*:*:*:*:* Versions 5.9.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.9.1:*:*:*:*:*:*:* Versions 5.9.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:activemq:5.10.0:*:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-4vhf-2hv7-8mrx org.apache.activemq:activemq-client (Maven) Fixed in 5.10.1 Advisory →
  • Fix · GHSA-4vhf-2hv7-8mrx org.apache.activemq:activemq-broker (Maven) Fixed in 5.10.1 Advisory →

Red Hat 2 advisories

  • RHSA-2015:0137 Released 2015-02-05 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.1.0 security and bug fix update
    • Red Hat JBoss A-MQ 6.1
    • Red Hat JBoss Fuse 6.1
  • RHSA-2015:0138 Released 2015-02-05 · Red Hat rating Important
    Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 security update
    • Fuse ESB Enterprise 7.1.0
    • Fuse MQ Enterprise 7.1.0
    • Fuse Management Console 7.1.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Enterprise 1AffectedNo fix planned: Will not fix
Red Hat JBoss SOA Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Enterprise 2AffectedNo fix planned: Will not fix
Fuse ESB Enterprise 7.1.0Fixed RHSA-2015:0138
Fuse MQ Enterprise 7.1.0Fixed RHSA-2015:0138
Fuse Management Console 7.1.0Fixed RHSA-2015:0138
Red Hat JBoss A-MQ 6.1Fixed RHSA-2015:0137
Red Hat JBoss Fuse 6.1Fixed RHSA-2015:0137

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-3600
  2. 2026-10-03 Alias added: GHSA-4vhf-2hv7-8mrx
  3. 2026-10-28 EPSS moved to the 90th–95th percentile

References

Advisory 4

Other 4

  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
  • TI-2016-02587 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-26494 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans KEVCVSS 3.1HIGH 8.8
  • TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
  • TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
  • TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
See all 74 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences