CVE-2014-9649: XSS
Published Jan 27, 2015
·Updated
Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.
Affected Software
88 affected components
VMware RabbitMQ=2.1.0
VMware RabbitMQ=2.1.1
VMware RabbitMQ=2.2.0
VMware RabbitMQ=2.3.0
VMware RabbitMQ=2.3.1
VMware RabbitMQ=2.4.0
VMware RabbitMQ=2.4.1
VMware RabbitMQ=2.5.0
VMware RabbitMQ=2.5.1
VMware RabbitMQ=2.6.0
VMware RabbitMQ=2.6.1
VMware RabbitMQ=2.7.0
VMware RabbitMQ=2.7.1
VMware RabbitMQ=2.8.0
VMware RabbitMQ=2.8.1
VMware RabbitMQ=2.8.2
VMware RabbitMQ=2.8.3
VMware RabbitMQ=2.8.4
VMware RabbitMQ=2.8.5
VMware RabbitMQ=2.8.6
VMware RabbitMQ=2.8.7
VMware RabbitMQ=3.0.0
VMware RabbitMQ=3.0.1
VMware RabbitMQ=3.0.2
VMware RabbitMQ=3.0.3
VMware RabbitMQ=3.0.4
VMware RabbitMQ=3.1.0
VMware RabbitMQ=3.1.1
VMware RabbitMQ=3.1.2
VMware RabbitMQ=3.1.3
VMware RabbitMQ=3.1.4
VMware RabbitMQ=3.1.5
VMware RabbitMQ=3.2.0
VMware RabbitMQ=3.2.1
VMware RabbitMQ=3.2.2
VMware RabbitMQ=3.2.3
VMware RabbitMQ=3.2.4
VMware RabbitMQ=3.3.0
VMware RabbitMQ=3.3.1
VMware RabbitMQ=3.3.2
VMware RabbitMQ=3.3.3
VMware RabbitMQ=3.3.4
VMware RabbitMQ=3.3.5
VMware RabbitMQ=3.4.0
Broadcom Rabbitmq Server=2.1.0
Broadcom Rabbitmq Server=2.1.1
Broadcom Rabbitmq Server=2.2.0
Broadcom Rabbitmq Server=2.3.0
Broadcom Rabbitmq Server=2.3.1
Broadcom Rabbitmq Server=2.4.0
Broadcom Rabbitmq Server=2.4.1
Broadcom Rabbitmq Server=2.5.0
Broadcom Rabbitmq Server=2.5.1
Broadcom Rabbitmq Server=2.6.0
Broadcom Rabbitmq Server=2.6.1
Broadcom Rabbitmq Server=2.7.0
Broadcom Rabbitmq Server=2.7.1
Broadcom Rabbitmq Server=2.8.0
Broadcom Rabbitmq Server=2.8.1
Broadcom Rabbitmq Server=2.8.2
Broadcom Rabbitmq Server=2.8.3
Broadcom Rabbitmq Server=2.8.4
Broadcom Rabbitmq Server=2.8.5
Broadcom Rabbitmq Server=2.8.6
Broadcom Rabbitmq Server=2.8.7
Broadcom Rabbitmq Server=3.0.0
Broadcom Rabbitmq Server=3.0.1
Broadcom Rabbitmq Server=3.0.2
Broadcom Rabbitmq Server=3.0.3
Broadcom Rabbitmq Server=3.0.4
Broadcom Rabbitmq Server=3.1.0
Broadcom Rabbitmq Server=3.1.1
Broadcom Rabbitmq Server=3.1.2
Broadcom Rabbitmq Server=3.1.3
Broadcom Rabbitmq Server=3.1.4
Broadcom Rabbitmq Server=3.1.5
Broadcom Rabbitmq Server=3.2.0
Broadcom Rabbitmq Server=3.2.1
Broadcom Rabbitmq Server=3.2.2
Broadcom Rabbitmq Server=3.2.3
Broadcom Rabbitmq Server=3.2.4
Broadcom Rabbitmq Server=3.3.0
Broadcom Rabbitmq Server=3.3.1
Broadcom Rabbitmq Server=3.3.2
Broadcom Rabbitmq Server=3.3.3
Broadcom Rabbitmq Server=3.3.4
Broadcom Rabbitmq Server=3.3.5
Broadcom Rabbitmq Server=3.4.0
Event History
Jan 27, 2015
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9649?
CVE-2014-9649 is classified as a medium severity vulnerability due to the potential for cross-site scripting attacks.
2
How do I fix CVE-2014-9649?
To fix CVE-2014-9649, upgrade your RabbitMQ installation to version 3.4.1 or later.
3
What versions of RabbitMQ are affected by CVE-2014-9649?
CVE-2014-9649 affects RabbitMQ versions from 2.1.0 up to 3.4.0.
4
What type of vulnerability is CVE-2014-9649?
CVE-2014-9649 is a cross-site scripting (XSS) vulnerability found in the RabbitMQ management plugin.
5
Can CVE-2014-9649 be exploited remotely?
Yes, CVE-2014-9649 can be exploited remotely by attackers through crafted requests to the RabbitMQ API.