Medium severity · published Jun 28, 2021
CVE-2021-32719
RabbitMQ is a multi-protocol messaging broker
4.8
CVSS
1.4%
EPSS
No
On KEV
Description
RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the `rabbitmq_federation_management` plugin, its consumer tag was rendered without proper <script> tag sanitization. This potentially allows for JavaScript code execution in the context of the page. The user must be signed in and have elevated permissions (manage federation upstreams and policies) for this to occur. The vulnerability is patched in RabbitMQ 3.8.18. As a workaround, disable the `rabbitmq_federation_management` plugin and use [CLI tools](https://www.rabbitmq.com/cli.html) instead.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Rabbitmq · Vmware
before 3.8.18 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-32719
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-32719
Patch
https://github.com/rabbitmq/rabbitmq-server/pull/3122
Mitigation
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5452-hxj4-773x
Exploit
https://herolab.usd.de/security-advisories/usd-2021-0011/
More from Rabbitmq
7.5
CVE-2022-31008
Predictable credential obfuscation seed value used in rabbitmq-server
7.5
CVE-2021-22116
RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint
5.4
CVE-2021-32718
RabbitMQ is a multi-protocol messaging broker
4.9
CVE-2023-46118
RabbitMQ is a multi-protocol messaging and streaming broker
4.8
CVE-2019-11291
Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain…