Medium severity · published Jun 28, 2021
CVE-2021-32718
RabbitMQ is a multi-protocol messaging broker
5.4
CVSS
1.4%
EPSS
No
On KEV
Description
RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `<script>` tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The vulnerability is patched in RabbitMQ 3.8.17. As a workaround, disable `rabbitmq_management` plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Rabbitmq · Vmware
before 3.8.17 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-32718
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-32718
Exploit
http://seclists.org/fulldisclosure/2021/Dec/3
Patch
https://github.com/rabbitmq/rabbitmq-server/pull/3028
Mitigation
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c3hj-rg5h-2772
More from Rabbitmq
7.5
CVE-2022-31008
Predictable credential obfuscation seed value used in rabbitmq-server
7.5
CVE-2021-22116
RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint
4.9
CVE-2023-46118
RabbitMQ is a multi-protocol messaging and streaming broker
4.8
CVE-2021-32719
RabbitMQ is a multi-protocol messaging broker
4.8
CVE-2019-11291
Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain…