CVE-2021-32719

Katalog CVE

CVSS 4.8 · Medium EPSS 1,4%

Kerentanan Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) pada vmware rabbitmq. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the `rabbitmq_federation_management` plugin, its consumer tag was rendered without proper <script> tag sanitization. This potentially allows for JavaScript code execution in the context of the page. The user must be signed in and have elevated permissions (manage federation upstreams and policies) for this to occur. The vulnerability is patched in RabbitMQ 3.8.18. As a workaround, disable the `rabbitmq_federation_management` plugin and use [CLI tools](https://www.rabbitmq.com/cli.html) instead.

Rincian

Terbit di NVD

28 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 72,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rabbitmq/rabbitmq-server/pull/3122 patch · advisory pihak ketiga
• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5452-hxj4-773x mitigasi · advisory pihak ketiga
• https://herolab.usd.de/security-advisories/usd-2021-0011/ exploit · advisory pihak ketiga