Riskcovery

CVE-2019-11291

RabbitMQ XSS attack via federation and shovel endpoints

State
Published
Severity
3.1 Low
Published
Nov 22, 2019
Updated
Sep 17, 2024
Reserved
Apr 18, 2019

Read the record on cve.org

Description

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.

Scores

CVSSScoreVectorSource
3.03.1 LowCVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:Npivotal

Weaknesses

  • CWE-79 Cross-site Scripting (XSS) - Generic

Affected Products

ProductVersions
RabbitMQPivotal
  • 3.8 to before v3.8.1Affected
  • 3.7 to before v3.7.20Affected
RabbitMQ for Pivotal PlatformPivotal
  • 1.17 to before 1.17.4Affected
  • 1.16 to before 1.16.7Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.