CVE-2014-9650
published 2015-01-27CVE-2014-9650: CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and…
PriorityP427medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
2.62%
83.8th percentile
CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.
Affected
49 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
| broadcom | rabbitmq_server | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7vh8-m3cm-3hh4: CRLF injection vulnerability in the management plugin in RabbitMQ 2
ghsa_unreviewed·2022-05-13
CVE-2014-9650 [MEDIUM] GHSA-7vh8-m3cm-3hh4: CRLF injection vulnerability in the management plugin in RabbitMQ 2
CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.
OSV
CVE-2014-9650: CRLF injection vulnerability in the management plugin in RabbitMQ 2
osv·2015-01-27·CVSS 5.0
CVE-2014-9650 [MEDIUM] CVE-2014-9650: CRLF injection vulnerability in the management plugin in RabbitMQ 2
CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.
Red Hat
RabbitMQ: /api/definitions response splitting vulnerability
vendor_redhat·2014-10-29·CVSS 5.0
CVE-2014-9650 [MEDIUM] CWE-113 RabbitMQ: /api/definitions response splitting vulnerability
RabbitMQ: /api/definitions response splitting vulnerability
CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.
A response-splitting vulnerability was discovered in RabbitMQ. An /api/definitions URL could be specified, which then caused an arbitrary additional header to be returned. A remote attacker could use this flaw to inject arbitrary HTTP headers and possibly gain access to secure data.
Package: rabbitmq-server (Red Hat OpenStack Platform 8 (Liberty)) - Affected
Debian
CVE-2014-9650: rabbitmq-server - CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through ...
vendor_debian·2014·CVSS 5.0
CVE-2014-9650 [MEDIUM] CVE-2014-9650: rabbitmq-server - CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through ...
CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.
Scope: local
bookworm: resolved (fixed in 3.4.1-1)
bullseye: resolved (fixed in 3.4.1-1)
forky: resolved (fixed in 3.4.1-1)
sid: resolved (fixed in 3.4.1-1)
trixie: resolved (fixed in 3.4.1-1)
No detection rules found.
No public exploits indexed.
http://rhn.redhat.com/errata/RHSA-2016-0308.htmlhttp://www.openwall.com/lists/oss-security/2015/01/21/13http://www.rabbitmq.com/release-notes/README-3.4.1.txthttp://www.securityfocus.com/bid/76091https://groups.google.com/forum/#%21topic/rabbitmq-users/-3Z2FyGtXhshttp://rhn.redhat.com/errata/RHSA-2016-0308.htmlhttp://www.openwall.com/lists/oss-security/2015/01/21/13http://www.rabbitmq.com/release-notes/README-3.4.1.txthttp://www.securityfocus.com/bid/76091https://groups.google.com/forum/#%21topic/rabbitmq-users/-3Z2FyGtXhs
2015-01-27
Published