Unrated severityNVD Advisory· Published Jun 28, 2021· Updated Aug 3, 2024
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ federation management plugin
CVE-2021-32719
Description
RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the rabbitmq_federation_management plugin, its consumer tag was rendered without proper tag sanitization. This potentially allows for JavaScript code execution in the context of the page. The user must be signed in and have elevated permissions (manage federation upstreams and policies) for this to occur. The vulnerability is patched in RabbitMQ 3.8.18. As a workaround, disable the rabbitmq_federation_management plugin and use CLI tools instead.
Affected products
12- osv-coords11 versionspkg:bitnami/rabbitmqpkg:rpm/opensuse/elixir115&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/erlang26&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/rabbitmq-server313&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/rabbitmq-server&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/rabbitmq-server&distro=openSUSE%20Leap%2015.3pkg:rpm/suse/elixir115&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP6pkg:rpm/suse/erlang26&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP6pkg:rpm/suse/rabbitmq-server313&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP6pkg:rpm/suse/rabbitmq-server&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP2pkg:rpm/suse/rabbitmq-server&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP3
< 3.8.18+ 10 more
- (no CPE)range: < 3.8.18
- (no CPE)range: < 1.15.7-150300.7.5.1
- (no CPE)range: < 26.2.1-150300.7.5.1
- (no CPE)range: < 3.13.1-150600.13.5.3
- (no CPE)range: < 3.8.3-lp152.2.3.1
- (no CPE)range: < 3.8.11-3.3.3
- (no CPE)range: < 1.15.7-150300.7.5.1
- (no CPE)range: < 26.2.1-150300.7.5.1
- (no CPE)range: < 3.13.1-150600.13.5.3
- (no CPE)range: < 3.8.3-3.3.4
- (no CPE)range: < 3.8.11-3.3.3
- Range: < 3.8.18
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/rabbitmq/rabbitmq-server/pull/3122mitrex_refsource_MISC
- github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5452-hxj4-773xmitrex_refsource_CONFIRM
- herolab.usd.de/security-advisories/usd-2021-0011/mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.