CVE-2019-11291: RabbitMQ XSS attack via federation and shovel endpoints
First published: Fri Nov 22 2019(Updated: )
Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.
Credit: security@pivotal.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/rabbitmq-server | <3.7.20 | 3.7.20 |
| redhat/rabbitmq-server | <3.8.1 | 3.8.1 |
| Vmware Rabbitmq | >=1.16.0<1.16.7 | |
| Vmware Rabbitmq | >=1.17.0<1.17.4 | |
| Vmware Rabbitmq | >=3.7.0<3.7.20 | |
| Vmware Rabbitmq | =3.8.0 | |
| Redhat Openstack | =15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1783329
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1783328
- https://pivotal.io/security/cve-2019-11291
- https://access.redhat.com/errata/RHSA-2020:0553
- https://access.redhat.com/security/cve/cve-2019-11291
- https://github.com/rabbitmq/rabbitmq-federation-management/commit/7dfd6f98688e54cfbdc0370537df705cfb65177e
- https://github.com/rabbitmq/rabbitmq-shovel-management/commit/4ed231a13054f9bab228462c82dfa977429436c8
- https://bugzilla.redhat.com/show_bug.cgi?id=1783327
Frequently Asked Questions
What is the severity of CVE-2019-11291?
The severity of CVE-2019-11291 is medium with a CVSS score of 4.8.
Which versions of Pivotal RabbitMQ are affected by CVE-2019-11291?
Pivotal RabbitMQ versions prior to v3.7.20 and 3.8 version prior to v3.8.1 are affected.
Which versions of RabbitMQ for PCF are affected by CVE-2019-11291?
RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4 are affected.
What is the vulnerability description of CVE-2019-11291?
CVE-2019-11291 allows a remote authenticated malicious user to exploit two endpoints (federation and shovel) that do not properly sanitize user input.
Is there a fix available for CVE-2019-11291?
Yes, the fix for CVE-2019-11291 is available in Pivotal RabbitMQ version v3.7.20, 3.8 version v3.8.1, RabbitMQ for PCF version 1.16.7, and 1.17.4.
- collector/nvd-index
- agent/type
- agent/references
- agent/softwarecombine
- agent/author
- agent/weakness
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-11291
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/severity
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/vmware
- canonical/vmware rabbitmq
- version/vmware rabbitmq/1.16.0
- version/vmware rabbitmq/1.17.0
- version/vmware rabbitmq/3.7.0
- version/vmware rabbitmq/3.8.0
- vendor/redhat
- canonical/redhat openstack
- version/redhat openstack/15
- package-manager/redhat