CVE-2021-32718

CWE-80CWE-79 — Cross-site Scripting (XSS)7 documents6 sources
Severity
5.4MEDIUM
EPSS
0.1%
top 69.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Rabbitmq Rabbitmq-serverVmware Rabbitmq
Timeline
PublishedJun 28
Latest updateDec 9

Description

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `` tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The vulnerability is patched in RabbitMQ 3.8.17. As a workaround, disabl…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:NExploitability: 0.5 | Impact: 2.5

Affected Packages4 packages

▶CVEListV5rabbitmq/rabbitmq-server< 3.8.17
▶Debianrabbitmq-server< 3.9.4-1+2
▶Ubunturabbitmq-server< 3.8.3-0ubuntu0.2
▶NVDvmware/rabbitmq< 3.8.17

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
OSV
rabbitmq-server vulnerabilities↗2024-12-09
▶
CVEList
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UI↗2021-06-28
▶
OSV
CVE-2021-32718: RabbitMQ is a multi-protocol messaging broker↗2021-06-28
▶

📋Vendor Advisories

3
Ubuntu
RabbitMQ Server vulnerabilities↗2024-12-09
▶
Red Hat
rabbitmq-server: improper neutralization of script-related HTML tags in a web page (basic XSS) in management UI↗2021-05-06
▶
Debian
CVE-2021-32718: rabbitmq-server - RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to versi...↗2021
▶
CVE-2021-32718 (MEDIUM CVSS 5.4) | RabbitMQ is a multi-protocol messag | cvebase.io