p PatchFirst

CVE-2019-11291

CVE-2019-11291 · RabbitMQ XSS attack via federation and shovel endpoints

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.

CVSS 3.1 · Low · EPSS 0.8% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • rabbitmq

    Versions
    • ≥ 3.8, < v3.8.1: Affected (custom)
    • ≥ 3.7, < v3.7.20: Affected (custom)

    Update to v3.7.20; Update to v3.8.1

  • rabbitmq for pivotal platform

    Versions
    • ≥ 1.17, < 1.17.4: Affected (custom)
    • ≥ 1.16, < 1.16.7: Affected (custom)

    Update to 1.16.7; Update to 1.17.4

  • rabbitmq-server Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.8.3-1

    Update to 3.8.3-1

  • rabbitmq-server Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.8.3-1

    Update to 3.8.3-1

  • rabbitmq-server Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.8.3-1

    Update to 3.8.3-1

Original sources

Check your server →