VulnerabilityModified
CVE-2014-3629
XML external entity (XXE) vulnerability in the XML Exchange module in Apache Qpid 0.30 allows remote attackers to cause outgoing HTTP connections via a crafted message.
MEDIUM 4.3EPSS 6.92%
Does this matter?
Lower severity and a low EPSS score (6.92%). Track it; it rarely justifies an emergency change on its own.
Description
XML external entity (XXE) vulnerability in the XML Exchange module in Apache Qpid 0.30 allows remote attackers to cause outgoing HTTP connections via a crafted message.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 6.92% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-19
- Affected
- apache/qpid
- Source
- secalert@redhat.com
References
- http://packetstormsecurity.com/files/129034/Apache-Qpid-0.30-Induced-HTTP-Requests.html
- http://secunia.com/advisories/62235
- http://www.securityfocus.com/archive/1/533943/100/0/threaded
- http://www.securityfocus.com/bid/71004
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98575
- http://packetstormsecurity.com/files/129034/Apache-Qpid-0.30-Induced-HTTP-Requests.html
- http://secunia.com/advisories/62235
- http://www.securityfocus.com/archive/1/533943/100/0/threaded
- http://www.securityfocus.com/bid/71004
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98575
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.