PT-2017-4083 · Pivotal+1 · Rabbitmq For Pcf+1

Published 2017-06-13 · Updated 2025-04-02 · CVE-2017-4965

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.4.x through 3.5.x and 3.6.x prior to 3.6.9 RabbitMQ for PCF versions 1.5.x and 1.6.x prior to 1.6.18 and 1.7.x prior to 1.7.15

Description The issue is related to insufficient protection measures in the RabbitMQ management UI, which makes several forms vulnerable to XSS attacks. This could allow a remote attacker to impact data integrity.

Recommendations For RabbitMQ versions 3.4.x through 3.5.x and 3.6.x prior to 3.6.9, update to version 3.6.9 or later. For RabbitMQ for PCF versions 1.5.x, update to version 1.6.18 or later. For RabbitMQ for PCF versions 1.6.x prior to 1.6.18, update to version 1.6.18 or later. For RabbitMQ for PCF versions 1.7.x prior to 1.7.15, update to version 1.7.15 or later. As a temporary workaround, consider restricting access to the RabbitMQ management UI to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-01440

BDU:2021-01441

CVE-2017-4965

DLA-2710-1

DLA-2710-2

SUSE-RU-2020:2072-1

Affected Products

Rabbitmq

Rabbitmq For Pcf

References · 111

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-11287-DoS%20via%20Heap%20Overflow-RabbitMQ%20Web%20Management%20Plugin · Exploit
• https://security-tracker.debian.org/tracker/source-package/rabbitmq-server · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-4965 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-4965 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05251 · Security Note
• https://bdu.fstec.ru/vul/2021-05248 · Security Note
• https://bdu.fstec.ru/vul/2021-01440 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-4965 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-4965 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-4965 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20211008SE16 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-2710-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-4965 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01405 · Security Note
• https://osv.dev/vulnerability/DLA-2710-2 · Vendor Advisory