CVE-2021-32718

MEDIUM Year: 2021
CVSS v3 Score
5.4
Medium
CVSS v2 Score
3.5
Low
Weakness Type
CWE-80
View all →

Vulnerability Description

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `<script>` tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The vulnerability is patched in RabbitMQ 3.8.17. As a workaround, disable `rabbitmq_management` plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring.

Related Vulnerabilities

CVE-2017-20034

MEDIUM
CVSS:5.4(Medium)

A vulnerability classified as problematic was found in PHPList 3.2.6. This vulnerability affects unknown code of the file /lists/admin/ of the component List Name. The manipulation leads to cross site...

CWE-802017

CVE-2017-20035

MEDIUM
CVSS:5.4(Medium)

A vulnerability, which was classified as problematic, has been found in PHPList 3.2.6. This issue affects some unknown processing of the file /lists/admin/ of the component Subscribe. The manipulation...

CWE-802017

CVE-2017-20036

MEDIUM
CVSS:5.4(Medium)

A vulnerability, which was classified as problematic, was found in PHPList 3.2.6. Affected is an unknown function of the file /lists/admin/ of the component Bounce Rule. The manipulation leads to cros...

CWE-802017

CVE-2017-20043

MEDIUM
CVSS:5.4(Medium)

A vulnerability was found in Navetti PricePoint 4.6.0.0 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting (Persi...

CWE-802017

CVE-2017-20044

MEDIUM
CVSS:5.4(Medium)

A vulnerability was found in Navetti PricePoint 4.6.0.0. It has been classified as problematic. This affects an unknown part. The manipulation leads to basic cross site scripting (Reflected). It is po...

CWE-802017

CVE-2017-20054

MEDIUM
CVSS:5.4(Medium)

A vulnerability was found in XYZScripts Contact Form Manager Plugin. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site ...

CWE-802017