CVE-2021-32718: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UI
Last updated 9 December 2024
Other sources
RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper <script> tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The vulnerability is patched in RabbitMQ 3.8.17. As a workaround, disable rabbitmqmanagement plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-32718?
CVE-2021-32718 is a vulnerability in RabbitMQ that allows for potential JavaScript code execution.
How does CVE-2021-32718 affect RabbitMQ?
CVE-2021-32718 affects RabbitMQ versions prior to 3.8.17.
What is the severity of CVE-2021-32718?
CVE-2021-32718 has a severity rating of medium, with a CVSS score of 5.4.
How can CVE-2021-32718 be exploited?
CVE-2021-32718 can be exploited by adding a new user via the management UI with malicious JavaScript code, which may lead to code execution.
How can I fix CVE-2021-32718?
To fix CVE-2021-32718, upgrade RabbitMQ to version 3.8.17 or later to address the vulnerability.