Rabbitmq · Rabbitmq · CVE-2021-32718
**Name of the Vulnerable Software and Affected Versions**
RabbitMQ versions prior to 3.8.17
**Description**
The issue concerns a potential JavaScript code execution in the context of the page when a new user is added via the management UI. This occurs due to insufficient sanitization of the `<script>` tag in the user's name, which is rendered in a confirmation message. The exploitation requires the user to be signed in and have elevated permissions for other user management.
**Recommendations**
For versions prior to 3.8.17, update to RabbitMQ 3.8.17 to resolve the issue.
As a temporary workaround, consider disabling the `rabbitmq management` plugin and use CLI tools for management operations, along with Prometheus and Grafana for metrics and monitoring.