CVEvulnerability

CVE-2014-9494

5.0 MEDIUM Published 2015-01-20 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2015-01-20
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 2.0 ([email protected]): 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses: CWE-264

Description

RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a crafted X-Forwareded-For header.

Affected configurations

• pivotal software rabbitmq (<= 3.3.5)

Related

Weakness · not in database (1)

CWE-264

References

http://seclists.org/oss-sec/2015/q1/30 seclists.org
http://www.rabbitmq.com/release-notes/README-3.4.0.txt Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/99685 exchange.xforce.ibmcloud.com
https://groups.google.com/forum/#%21topic/rabbitmq-users/DMkypbSvIyM groups.google.com
http://seclists.org/oss-sec/2015/q1/30 seclists.org
http://www.rabbitmq.com/release-notes/README-3.4.0.txt Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/99685 exchange.xforce.ibmcloud.com
https://groups.google.com/forum/#%21topic/rabbitmq-users/DMkypbSvIyM groups.google.com