CVE-2014-9494

Description

RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a crafted X-Forwareded-For header.

Related CPE's

a pivotal_software rabbitmq ********

References

http://www.rabbitmq.com/release-notes/README-3.4.0.txt

Vendor Advisory

[oss-security] 20150103 Re: CVE request: insufficient 'X-Forwarded-For' header validation in rabbitmq-server

rabbitmq-cve20149494-sec-bypass(99685)

https://groups.google.com/forum/#!topic/rabbitmq-users/DMkypbSvIyM

CvssV3 impact

Could not find any metrics

CvssV2 impact

Version	2.0
VectorString	AV:N/AC:L/Au:N/C:N/I:P/A:N
AccessVector	NETWORK
AccessComplexity	LOW
Authentication	NONE
ConfidentialityImpact	NONE
IntegrityImpact	PARTIAL
AvailabilityImpact	NONE
BaseScore	5

Created by Yello

About Severity.io