CVE-2014-3599 HornetQ REST vulnerable to Improper Restriction of XML External Entity Reference
An XML External Entity vulnerability in HornetQ REST allows attackers to read sensitive files or cause denial of service via crafted XML input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2014-3599?
CVE-2014-3599 is a medium-severity vulnerability in HornetQ REST, published on 12 Nov 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy
Weakness: CWE-611
Which versions are affected by CVE-2014-3599?
2 open source packages ship an affected version, including org.hornetq.rest:hornetq-rest. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.hornetq.rest:hornetq-rest Maven | All versions | 2.5.0.Beta1 |
org.hornetq.rest:hornetq-rest Maven | All versions | 2.5.0.Beta1 |
Products include Redhat Hornetq.
How do I fix CVE-2014-3599?
Upgrade org.hornetq.rest:hornetq-rest to 2.5.0.Beta1 or later.
Is CVE-2014-3599 being exploited?
There is no known exploitation of CVE-2014-3599 in the wild and no public exploit code.
Other vulnerabilities in HornetQ REST
Sources
Also known as GHSA-xrh2-c3rm-35jr.