CVE-2021-32718: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UI
First published: Mon Jun 28 2021(Updated: )
RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `<script>` tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The vulnerability is patched in RabbitMQ 3.8.17. As a workaround, disable `rabbitmq_management` plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Vmware Rabbitmq | <3.8.17 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-32718?
CVE-2021-32718 is a vulnerability in RabbitMQ that allows for potential JavaScript code execution.
How does CVE-2021-32718 affect RabbitMQ?
CVE-2021-32718 affects RabbitMQ versions prior to 3.8.17.
What is the severity of CVE-2021-32718?
CVE-2021-32718 has a severity rating of medium, with a CVSS score of 5.4.
How can CVE-2021-32718 be exploited?
CVE-2021-32718 can be exploited by adding a new user via the management UI with malicious JavaScript code, which may lead to code execution.
How can I fix CVE-2021-32718?
To fix CVE-2021-32718, upgrade RabbitMQ to version 3.8.17 or later to address the vulnerability.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/author
- agent/remedy
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/severity
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/vmware
- canonical/vmware rabbitmq