CVE-2025-30219
published 2025-03-25CVE-2025-30219: RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and…
PriorityP428medium6.1CVSS 3.1
AVLACHPRHUINSCCHINAL
EPSS
0.20%
10.3th percentile
RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions
will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user's browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | rabbitmq-server | < rabbitmq-server 4.0.5-1 (forky) | rabbitmq-server 4.0.5-1 (forky) |
| msrc | azl3_rabbitmq-server_3.13.7-2_on_azure_linux_3.0 | — | — |
| msrc | cbl2_rabbitmq-server_3.11.24-3_on_cbl_mariner_2.0 | — | — |
| rabbitmq | rabbitmq-server | < 4.0.3 | 4.0.3 |
| rabbitmq | rabbitmq-server | >= 0 < 4.0.5-1 | 4.0.5-1 |
| rabbitmq | rabbitmq-server | >= 0 < 4.0.5-1 | 4.0.5-1 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L
osv6.1MEDIUM
vendor_debian6.1MEDIUM
vendor_msrc6.1MEDIUM
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
RabbitMQ Server vulnerability
vendor_ubuntu·2025-03-31
CVE-2025-30219 RabbitMQ Server vulnerability
Title: RabbitMQ Server vulnerability
Summary: RabbitMQ Server's management UI could be made to run code via
cross-site scripting (XSS).
It was discovered that RabbitMQ Server's management UI did not sanitize
certain input. An attacker could possibly use this issue to inject code
by performing a cross-site scripting (XSS) attack.
Instructions: After a standard system update you need to restart RabbitMQ Server to make
all the necessary changes.
Red Hat
rabbitmq: RabbitMQ has XSS Vulnerability in an Error Message in Management UI
vendor_redhat·2025-03-25·CVSS 6.1
CVE-2025-30219 [MEDIUM] CWE-79 rabbitmq: RabbitMQ has XSS Vulnerability in an Error Message in Management UI
rabbitmq: RabbitMQ has XSS Vulnerability in an Error Message in Management UI
RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions
will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes th
Microsoft
RabbitMQ has XSS Vulnerability in an Error Message in Management UI
vendor_msrc·2025-03-11·CVSS 6.1
CVE-2025-30219 [MEDIUM] CWE-79 RabbitMQ has XSS Vulnerability in an Error Message in Management UI
RabbitMQ has XSS Vulnerability in an Error Message in Management UI
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Refere
Debian
CVE-2025-30219: rabbitmq-server - RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulner...
vendor_debian·2025·CVSS 6.1
CVE-2025-30219 [MEDIUM] CVE-2025-30219: rabbitmq-server - RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulner...
RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript c
OSV
CVE-2025-30219: RabbitMQ is a messaging and streaming broker
osv·2025-03-25·CVSS 6.1
CVE-2025-30219 [MEDIUM] CVE-2025-30219: RabbitMQ is a messaging and streaming broker
RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript c
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-03-25
Published