CVE-2024-51988
CVE-2024-51988 · HTTP API's queue deletion endpoint does not verify that the user has a required permission
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configure` permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host & 3. HTTP API access. could delete queues it had no (deletion) permissions for. This issue has been addressed in version 3.12.11 of the open source rabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the tanzu release. Users are advised to upgrade. Users unable to upgrade may disable management plugin and use, for example, Prometheus and Grafana for monitoring.
CVSS 6.5 · Mittel · EPSS 0,4%
- Veröffentlicht
- Aktualisiert
Technologie-Stack: database
Betroffene Produkte und Versionen
rabbitmq
- Softwareversionen
- Open source RabbitMQ: >= 3.12.7, < 3.12.11: Betroffen
- Tanzu RabbitMQ: >= 2.0.0, < 3.13.0: Betroffen
- Tanzu RabbitMQ: < 1.5.2: Betroffen
Keine Korrektur veröffentlicht