What is GHSA-9pf7-f47q-mwpq?

GHSA-9pf7-f47q-mwpq is a security advisory published by GitHub Security Advisories with Low severity. Cross-site Scripting in RabbitMQ

Which CVE IDs does GHSA-9pf7-f47q-mwpq cover?

GHSA-9pf7-f47q-mwpq covers the following CVE IDs: CVE-2019-11291. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9pf7-f47q-mwpq?

GHSA-9pf7-f47q-mwpq has a CVSS v3 base score of 3.5, published by GitHub Security Advisories.

Which products are affected by GHSA-9pf7-f47q-mwpq?

GHSA-9pf7-f47q-mwpq affects 2 products, including: erlang/rabbit_common:\u003e= 3.7.0, \u003c 3.7.20; erlang/rabbit_common:\u003e= 3.8.0, \u003c 3.8.1.

GHSA-9pf7-f47q-mwpqLowCVSS 3.5

Cross-site Scripting in RabbitMQ

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2019-11291 →

📋 Description

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.

🎯 Affected products2

erlang/rabbit_common:>= 3.7.0, < 3.7.20
erlang/rabbit_common:>= 3.8.0, < 3.8.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-11291
https://access.redhat.com/errata/RHSA-2020:0553
https://pivotal.io/security/cve-2019-11291
https://github.com/advisories/GHSA-9pf7-f47q-mwpq