CVE-2026-57213

Katalog CVE

CVSS 4.8 · Medium EPSS 0,25%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada broadcom rabbitmq server. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_federation_management plugin renders the consumer_tag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute JavaScript in the browser of a user viewing that page. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

14 Juli 2026

Status NVD

Modified

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-qxrp-7cmp-p77h exploit · advisory vendor
• https://github.com/rabbitmq/rabbitmq-server/commit/33dedfe4fd53ff009cc67ab36358d0624c6b2e53 patch
• https://github.com/rabbitmq/rabbitmq-server/commit/c2d0d69edf01efbd6e87dfb250c373a32da957f8 patch
• https://github.com/rabbitmq/rabbitmq-server/pull/15708 issue tracking · patch
• https://github.com/rabbitmq/rabbitmq-server/pull/15711 issue tracking · patch
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.5 release notes