Apache ActiveMQ Apollo XXE Vulnerability
Date: 2022-05
Affected: maven/org.apache.activemq:apollo-project
Attack vector: xss
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2014-3579
CVE-2014-3600
CVE-2014-8110
CWE: CWE-611
CWE-79
CVSS: 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.


Mitigations:

Architectural layers (MAESTRO):