CVE-2021-22117

CWE-94 — Code InjectionCWE-732 — Incorrect Permission Assignment4 documents4 sources
Severity
7.8HIGH
EPSS
0.1%
top 71.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Broadcom Rabbitmq Server
Timeline
PublishedMay 18
Latest updateMay 24

Description

RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing attackers with sufficient local filesystem permissions to add arbitrary plugins.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶NVDbroadcom/rabbitmq_server3.8.0 — 3.8.16
▶CVEListV5rabbitmqRabbitMQ Windows installers prior to version 3.8.16

🔴Vulnerability Details

2
GHSA
GHSA-rwr9-36p6-24vw: RabbitMQ installers on Windows prior to version 3↗2022-05-24
▶
CVEList
CVE-2021-22117: RabbitMQ installers on Windows prior to version 3↗2021-05-18
▶

📋Vendor Advisories

1
Debian
CVE-2021-22117: rabbitmq-server - RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin dire...↗2021
▶
CVE-2021-22117 (HIGH CVSS 7.8) | RabbitMQ installers on Windows prio | cvebase.io