CVE-2019-11281: RabbitMQ XSS attack
Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack that would gain access to virtual hosts and policy management information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11281?
The severity of CVE-2019-11281 is medium with a CVSS score of 4.8.
Which versions of Pivotal RabbitMQ and RabbitMQ for PCF are affected by CVE-2019-11281?
Pivotal RabbitMQ versions prior to v3.7.18, RabbitMQ for PCF versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3 are affected by CVE-2019-11281.
What components in Pivotal RabbitMQ and RabbitMQ for PCF are affected by CVE-2019-11281?
The virtual host limits page and the federation management UI in Pivotal RabbitMQ and RabbitMQ for PCF are affected by CVE-2019-11281.
How can user input be improperly sanitized in Pivotal RabbitMQ and RabbitMQ for PCF?
User input may not be properly sanitized in the virtual host limits page and the federation management UI in Pivotal RabbitMQ and RabbitMQ for PCF.
How can I fix CVE-2019-11281?
To fix CVE-2019-11281, upgrade to Pivotal RabbitMQ version 3.7.18 or later and RabbitMQ for PCF version 1.15.13 or later.