Vulnerability · Published Jun 28, 2021 · Assigned by GitHub_M

CVE-2021-32718Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UI

Low 3.1

In plain English

A low-severity security flaw in rabbitmq-server from rabbitmq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)1.4%top 26.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `<script>` tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The vulnerability is patched in RabbitMQ 3.8.17. As a workaround, disable `rabbitmq_management` plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	rabbitmq-server	3.9.4-1	DEBIAN-CVE-2021-32718
Debian:13	rabbitmq-server	3.9.4-1	DEBIAN-CVE-2021-32718
Debian:14	rabbitmq-server	3.9.4-1	DEBIAN-CVE-2021-32718

Affected products (as reported)

Vendor	Product	Versions
rabbitmq	rabbitmq-server	< 3.8.17

Weakness: CWE-80 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c3hj-rg5h-2772 x_refsource_CONFIRM
https://github.com/rabbitmq/rabbitmq-server/pull/3028 x_refsource_MISC
20211203 usd AG Security Advisories 11/2021 mailing-list, x_refsource_FULLDISC