Skip to content
CVE PROGRAM SOURCE RECORD3.1 Low

CVE-2019-11291

RabbitMQ XSS attack via federation and shovel endpoints

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
pivotal

Description

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Pivotal RabbitMQ

  • 3.8 to < v3.8.1affected
  • 3.7 to < v3.7.20affected

Pivotal RabbitMQ for Pivotal Platform

  • 1.17 to < 1.17.4affected
  • 1.16 to < 1.16.7affected

References