GitHub Advisoryadvisory · Hex

GHSA-9pf7-f47q-mwpq Cross-site Scripting in RabbitMQ

LOW Published 2022-05-24 Modified 2022-07-05 Official page ↗
Aliases
CVE-2019-11291
Ecosystem
Hex
Packages
rabbit_common
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-07-05

Affected packages

• Hex rabbit_common: >= 3.7.0, < 3.7.20 → fixed in 3.7.20 • Hex rabbit_common: >= 3.8.0, < 3.8.1 → fixed in 3.8.1

Description

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.

Related

Alias · CVE (1)

  • CVE-2019-11291 Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References