CVE-2019-11281 - RabbitMQ XSS attack

Back Back to CVE browser

MEDIUM

RabbitMQ XSS attack

Published Oct 16, 2019

4.8

MEDIUM

CVSS 3.1

EPSS 1.17%

Description

Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack that would gain access to virtual hosts and policy management information.

Affected products

Vendor Pivotal Product RabbitMQ Default
n/a
- Version
  prior to v3.7.18
  Status
  affected
  Constraints
  -
Vendor Pivotal Product RabbitMQ for PCF Default
n/a
- Version
  1.15.x prior to 1.15.13
  Status
  affected
  Constraints
  -
- Version
  1.17.x prior to 1.17.3
  Status
  affected
  Constraints
  -
- Version
  11.16.x prior to 1.16.6
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Pivotal

RabbitMQ

n/a

Version	Status	Constraints
prior to v3.7.18	affected	-

Pivotal

RabbitMQ for PCF

n/a

Version	Status	Constraints
1.15.x prior to 1.15.13	affected	-
1.17.x prior to 1.17.3	affected	-
11.16.x prior to 1.16.6	affected	-

Red Hat OpenStack Platform 15.0 (Stein)

rabbitmq-server-0:3.7.22-1.el8ost

Fixed · RHSA-2020:0078
CloudForms Management Engine 5

rabbitmq-server

Not affected
Red Hat Ansible Tower 3

rabbitmq-server

Not affected
Red Hat OpenStack Platform 10 (Newton)

rabbitmq-server

Will not fix
Red Hat OpenStack Platform 13 (Queens)

rabbitmq-server

Will not fix
Red Hat OpenStack Platform 14 (Rocky)

rabbitmq-server

Out of support scope

Product	Package	State	Advisory
Red Hat OpenStack Platform 15.0 (Stein)	rabbitmq-server-0:3.7.22-1.el8ost	Fixed	RHSA-2020:0078
CloudForms Management Engine 5	rabbitmq-server	Not affected	n/a
Red Hat Ansible Tower 3	rabbitmq-server	Not affected	n/a
Red Hat OpenStack Platform 10 (Newton)	rabbitmq-server	Will not fix	n/a
Red Hat OpenStack Platform 13 (Queens)	rabbitmq-server	Will not fix	n/a
Red Hat OpenStack Platform 14 (Rocky)	rabbitmq-server	Out of support scope	n/a

Remediation

Red Hat mitigation

There is no mitigation for this issue, the flaw can only be resolved by applying updates.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (10)

https://access.redhat.com/errata/RHSA-2020:0078
vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2019-11281
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1764329
Issue Tracking
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.18
https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEQ6O7PMNJKYFMQYHAB55L423GYK63SO/
vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYTGR3D5FW2O25RXZOTIZMOD2HAUVBE4/
vendor-advisoryx_refsource_FEDORA
https://nvd.nist.gov/vuln/detail/CVE-2019-11281
https://pivotal.io/security/cve-2019-11281
x_refsource_CONFIRMVendor Advisory
https://www.cve.org/CVERecord?id=CVE-2019-11281

Link	Providers	Tags
https://access.redhat.com/errata/RHSA-2020:0078		vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2019-11281		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1764329		Issue Tracking
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.18
https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEQ6O7PMNJKYFMQYHAB55L423GYK63SO/		vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYTGR3D5FW2O25RXZOTIZMOD2HAUVBE4/		vendor-advisoryx_refsource_FEDORA
https://nvd.nist.gov/vuln/detail/CVE-2019-11281
https://pivotal.io/security/cve-2019-11281		x_refsource_CONFIRMVendor Advisory
https://www.cve.org/CVERecord?id=CVE-2019-11281