CVE-2019-11291
Medium
Description
Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.
SeverityMedium
CVSS4.8
Exploit probability—
Product
Broadcom Rabbitmq Server
PublishedNov 22, 2019
First seenNov 22, 2019
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- broadcom rabbitmq_server3.7.20 or later
- vmware rabbitmq1.16.7, 1.17.4 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| broadcom rabbitmq_server | 3.7.0 ≤ v < 3.7.20, 3.8.0 | 3.7.20 |
| vmware rabbitmq | 1.16.0 ≤ v < 1.16.7, 1.17.0 ≤ v < 1.17.4 | 1.16.7, 1.17.4 |
| redhat openstack | 15 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.