CVE-2019-11291CWE-79

RabbitMQ XSS attack via federation and shovel endpoints

Low · published November 22, 2019

CVSS v3.0
3.1
EPSS
1%
Percentile
56.0
In the wild
Unconfirmed
What it is

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.

The record
Technical detail
CVSS v3.0
3.1 · LOW
Vector
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00796 · 56.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2019-11-22T22:56Z
EPSS history
Timeline
  • 22 NOV 22:56Z
    RabbitMQ XSS attack via federation and shovel endpoints
    cvelistv5