CVE-2019-11281
RabbitMQ XSS attack
- State
- Published
- Severity
- 2.4 Low
- Published
- Oct 16, 2019
- Updated
- Sep 16, 2024
- Reserved
- Apr 18, 2019
Description
Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack that would gain access to virtual hosts and policy management information.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 2.4 Low | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N | pivotal |
Weaknesses
- CWE-79 Cross-site Scripting (XSS) - Generic
Affected Products
| Product | Versions |
|---|---|
RabbitMQPivotal |
|
RabbitMQ for PCFPivotal |
|
References
- https://pivotal.io/security/cve-2019-11281
- FEDORA-2019-6497f51791vendor-advisory
- FEDORA-2019-74d2feb5bevendor-advisory
- RHSA-2020:0078vendor-advisory
- [debian-lts-announce] 20210719 [SECURITY] [DLA 2710-1] rabbitmq-server security updatemailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.