VYPR
← All advisories
Medium severity4.8NVD Advisory· Published Nov 22, 2019· Updated Jun 17, 2026

CVE-2019-11291

CVE-2019-11291

Description

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
rabbit_commonHex
>= 3.7.0, < 3.7.203.7.20
rabbit_commonHex
>= 3.8.0, < 3.8.13.8.1

Affected products

7
  • Broadcom Corporation/Rabbitmq Server2 versions
    cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*range: >=3.7.0,<3.7.20
    • cpe:2.3:a:broadcom:rabbitmq_server:3.8.0:*:*:*:*:*:*:*
  • Red Hat/Openstack
    cpe:2.3:a:redhat:openstack:15:*:*:*:*:*:*:*
  • VMware/RabbitMQ
    cpe:2.3:a:vmware:rabbitmq:*:*:*:*:*:pivotal_cloud_foundry:*:*
    Range: >=1.16.0,<1.16.7
  • ghsa-coords
    pkg:hex/rabbit_common
    Range: >= 3.7.0, < 3.7.20
  • Cloudfoundry/Rabbitmqcpe-rescue
    Range: 3.8
  • Pivotal/RabbitMQ for Pivotal Platformv5
    Range: 1.17

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.