Description
Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack that would gain access to virtual hosts and policy management information.
Related CPE's
a
pivotal_software
rabbitmq
o
fedoraproject
fedora
References
https://access.redhat.com/errata/RHSA-2020:0078
https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html
https://pivotal.io/security/cve-2019-11281
CVSS impact metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
4.8 · Medium
CVSS V3.1
CVSS V3.0
CVSS V2.0
Information
Source identifier
Vulnerability status
Modified
Published
2019-10-16T16:15:10.340
5 years agoLast modified
2023-11-07T03:02:52.030
1 year ago