Rabbitmq · Rabbitmq · CVE-2021-32719
**Name of the Vulnerable Software and Affected Versions**
RabbitMQ versions prior to 3.8.18
**Description**
The issue arises from the `rabbitmq federation management` plugin in RabbitMQ, where a federation link's consumer tag is rendered without proper sanitization of `<script>` tags in the management UI. This potentially allows for JavaScript code execution in the context of the page, but the user must be signed in and have elevated permissions for this to occur.
**Recommendations**
For versions prior to 3.8.18, update to RabbitMQ 3.8.18 to patch the vulnerability.
As a temporary workaround, consider disabling the `rabbitmq federation management` plugin and use CLI tools instead.