CVE-2021-32718: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UI
Vulnerability summary
CVE-2021-32718 is a medium (CVSS 5.4) vulnerability in rabbitmq rabbitmq-server. EPSS estimates a 1.43% chance of exploitation in the next 30 days, higher than 73% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 3.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 8 · Related 6Timeline
- 28-06-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `<script>` tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The vulnerability is patched in RabbitMQ 3.8.17. As a workaround, disable `rabbitmq_management` plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring.
CVSS metrics
6 scores · 5 sources · 2 versions- CVE.orgCNA3.1LowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:NDiffers
- OSV · Red hatEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.43%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.43% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (seclists.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-80Improper Neutralization of Script-Related HTML Tags in a Web PageThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
- CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected systems
Known conditions: network-reachable, administrative account, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- rabbitmq-server< 3.9.4-1
Rabbitmq1 product
- rabbitmq-server< 3.8.17
Redhat1 product
- rabbitmq-server< 0:3.7.23-9.el8ost
Ubuntu1 product
- rabbitmq-server< 3.8.3-0ubuntu0.2
Vmware1 product
- rabbitmq< 3.8.17
5 vendors · 5 products
References
13 links- github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c3hj-rg5h-2772X Refsource CONFIRMREPORTMitigationThird Party Advisory
