CVE-2019-11291: broadcom rabbitmq_server Cross-site Scripting
Vulnerability summary
CVE-2019-11291 is a medium (CVSS 4.8) Cross-site Scripting vulnerability in broadcom rabbitmq_server. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 55.6% of scored vulnerabilities.
Timeline
- 22-11-2019PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.
CVSS metrics
8 scores · 5 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated4.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated4.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- NVDNIST3.1LowCVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
- OSV · Red hatEcosystem advisory · calculated3.1LowCVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated3.1LowCVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.80%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
0.00 pp
From 0.80% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Pivotal2 products
- rabbitmq≥ 3.8, < v3.8.1 | ≥ 3.7, < v3.7.20
- rabbitmq for pivotal platform≥ 1.17, < 1.17.4 | ≥ 1.16, < 1.16.7
Redhat2 products
- openstack15
- rabbitmq-server< 0:3.7.23-2.el8ost
Broadcom1 product
- rabbitmq_server≥ 3.7.0, < 3.7.20 | 3.8.0
Debian1 product
- rabbitmq-server< 3.8.3-1
Ubuntu1 product
- rabbitmq-server< 3.5.7-1ubuntu0.16.04.4 | < 3.6.10-1ubuntu0.4 | < 3.8.2-0ubuntu1.1
Vmware1 product
- rabbitmq≥ 1.16.0, < 1.16.7 | ≥ 1.17.0, < 1.17.4
6 vendors · 8 products
References
11 links- access.redhat.com/errata/RHSA-2020:0553Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
