CVE-2020-5419CWE-427

RabbitMQ arbitrary code execution using local binary planting

Medium · published August 31, 2020

CVSS v3.0
6.7
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code execution. An attacker with write privileges to the RabbitMQ installation directory and local access on Windows could carry out a local binary hijacking (planting) attack and execute arbitrary code.

The record
Technical detail
CVSS v3.0
6.7 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00452 · 38.3th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2020-08-31T15:05Z
EPSS history
Timeline
  • 31 AUG 15:05Z
    RabbitMQ arbitrary code execution using local binary planting
    cvelistv5