PT-2017-4084 · Pivotal+1 · Rabbitmq For Pcf+1

Published 2017-06-13 · Updated 2025-04-02 · CVE-2017-4967

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.4.x through 3.5.x RabbitMQ versions 3.6.x prior to 3.6.9 RabbitMQ for PCF versions 1.5.x RabbitMQ for PCF versions 1.6.x prior to 1.6.18 RabbitMQ for PCF versions 1.7.x prior to 1.7.15

Description The issue is related to insufficient protection measures in the RabbitMQ management UI, which can be exploited by a remote attacker to impact data integrity. Several forms in the RabbitMQ management UI are vulnerable to XSS attacks.

Recommendations For RabbitMQ versions 3.4.x through 3.5.x, update to a version after 3.5.x. For RabbitMQ versions 3.6.x prior to 3.6.9, update to version 3.6.9 or later. For RabbitMQ for PCF versions 1.5.x, update to a version after 1.5.x. For RabbitMQ for PCF versions 1.6.x prior to 1.6.18, update to version 1.6.18 or later. For RabbitMQ for PCF versions 1.7.x prior to 1.7.15, update to version 1.7.15 or later. As a temporary workaround, consider restricting access to the vulnerable RabbitMQ management UI forms until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-01441

CVE-2017-4967

DLA-2710-1

DLA-2710-2

SUSE-RU-2020:2072-1

Affected Products

Rabbitmq

Rabbitmq For Pcf

References · 106

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-11287-DoS%20via%20Heap%20Overflow-RabbitMQ%20Web%20Management%20Plugin · Exploit
• https://security-tracker.debian.org/tracker/source-package/rabbitmq-server · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05251 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-4967 · Security Note
• https://bdu.fstec.ru/vul/2021-05248 · Security Note
• https://bdu.fstec.ru/vul/2021-01440 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-4965 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20211008SE16 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-2710-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-4967 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-4967 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01405 · Security Note
• https://osv.dev/vulnerability/DLA-2710-2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22116 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-4967 · Vendor Advisory