CVE-2024-51988
published 2024-11-06CVE-2024-51988: RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.37%
28.9th percentile
RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configure` permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host & 3. HTTP API access. could delete queues it had no (deletion) permissions for. This issue has been addressed in version 3.12.11 of the open source rabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the tanzu release. Users are advised to upgrade. Users unable to upgrade may disable management plugin and use, for example, Prometheus and Grafana for monitoring.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | >= 0 < 3.8.3-0ubuntu0.1 | 3.8.3-0ubuntu0.1 |
| rabbitmq | rabbitmq-server | >= 0 < 3.9.27-0ubuntu0.1 | 3.9.27-0ubuntu0.1 |
| rabbitmq | rabbitmq-server | >= 0 < 3.12.1-1ubuntu1 | 3.12.1-1ubuntu1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
osv6.5MEDIUM
vendor_debian6.5LOW
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rabbitmq: rabbitmq-server: HTTP API's queue deletion endpoint does not verify that the user has a required permission
vendor_redhat·2024-11-06·CVSS 6.5
CVE-2024-51988 [MEDIUM] CWE-284 rabbitmq: rabbitmq-server: HTTP API's queue deletion endpoint does not verify that the user has a required permission
rabbitmq: rabbitmq-server: HTTP API's queue deletion endpoint does not verify that the user has a required permission
RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configure` permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host & 3. HTTP API access. could delete queues it had no (deletion) permissions for. This issue has been addressed in version 3.12.11 of the open source rabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the tanzu release. Users are advised to upgrade. Users unable to upgrade may disable management plugin and use, for example, Prometheus and Grafana for monitoring.
A flaw was foun
Debian
CVE-2024-51988: rabbitmq-server - RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In af...
vendor_debian·2024·CVSS 6.5
CVE-2024-51988 [MEDIUM] CVE-2024-51988: rabbitmq-server - RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In af...
RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configure` permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host & 3. HTTP API access. could delete queues it had no (deletion) permissions for. This issue has been addressed in version 3.12.11 of the open source rabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the tanzu release. Users are advised to upgrade. Users unable to upgrade may disable management plugin and use, for example, Prometheus and Grafana for monitoring.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
OSV
CVE-2024-51988: RabbitMQ is a feature rich, multi-protocol messaging and streaming broker
osv·2024-11-06·CVSS 6.5
CVE-2024-51988 [MEDIUM] CVE-2024-51988: RabbitMQ is a feature rich, multi-protocol messaging and streaming broker
RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configure` permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host & 3. HTTP API access. could delete queues it had no (deletion) permissions for. This issue has been addressed in version 3.12.11 of the open source rabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the tanzu release. Users are advised to upgrade. Users unable to upgrade may disable management plugin and use, for example, Prometheus and Grafana for monitoring.
OSV
RabbitMQ HTTP API's queue deletion endpoint does not verify that the user has a required permission
osv·2024-11-06
CVE-2024-51988 [HIGH] RabbitMQ HTTP API's queue deletion endpoint does not verify that the user has a required permission
RabbitMQ HTTP API's queue deletion endpoint does not verify that the user has a required permission
### Summary
Queue deletion via the HTTP API was not verifying the `configure` permission of the user.
### Impact
Users who had all of the following:
1. Valid credentials
2. Some permissions for the target virtual host
3. HTTP API access
could delete queues it had no (deletion) permissions for.
### Workarounds
Disable management plugin and use, for example, [Prometheus and Grafana](https://www.rabbitmq.com/docs/prometheus) for monitoring.
### OWASP Classification
OWASP Top10 A01:2021 – Broken Access Control
GHSA
RabbitMQ HTTP API's queue deletion endpoint does not verify that the user has a required permission
ghsa·2024-11-06
CVE-2024-51988 [HIGH] CWE-284 RabbitMQ HTTP API's queue deletion endpoint does not verify that the user has a required permission
RabbitMQ HTTP API's queue deletion endpoint does not verify that the user has a required permission
### Summary
Queue deletion via the HTTP API was not verifying the `configure` permission of the user.
### Impact
Users who had all of the following:
1. Valid credentials
2. Some permissions for the target virtual host
3. HTTP API access
could delete queues it had no (deletion) permissions for.
### Workarounds
Disable management plugin and use, for example, [Prometheus and Grafana](https://www.rabbitmq.com/docs/prometheus) for monitoring.
### OWASP Classification
OWASP Top10 A01:2021 – Broken Access Control
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-11-06
Published