PT-2021-3479 · Rabbitmq+5 · Rabbitmq+5

Fahimhusain Raydurg · Published 2021-06-28 · Updated 2024-12-09 · CVE-2021-32719

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.8.18

Description The issue arises from the rabbitmq federation management plugin in RabbitMQ, where a federation link's consumer tag is rendered without proper sanitization of <script> tags in the management UI. This potentially allows for JavaScript code execution in the context of the page, but the user must be signed in and have elevated permissions for this to occur.

Recommendations For versions prior to 3.8.18, update to RabbitMQ 3.8.18 to patch the vulnerability. As a temporary workaround, consider disabling the rabbitmq federation management plugin and use CLI tools instead.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

BDU:2021-03490

BIT-RABBITMQ-2021-32719

CVE-2021-32719

GHSA-5452-HXJ4-773X

MGASA-2021-0390

OPENSUSE-SU-2021:1334-1

OPENSUSE-SU-2021:3325-1

OPENSUSE-SU-2021_1334-1

OPENSUSE-SU-2021_3325-1

RHSA-2022:8851

SUSE-FU-2024:2078-1

SUSE-SU-2021:3254-1

SUSE-SU-2021:3325-1

USN-7143-1

Affected Products

Astra Linux

Debian

Linuxmint

Rabbitmq

Suse

Ubuntu

References · 47

• 🔥 https://herolab.usd.de/security-advisories/usd-2021-0011 · Exploit
• https://github.com/rabbitmq/rabbitmq-server/pull/3122 · Patch
• https://ubuntu.com/security/CVE-2021-32718 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:3325-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-rabbitmq-2021-32719 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32719 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:3325-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32719 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-FU-2024:2078-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32719 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1334-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7143-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0319SE17 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32719 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0390 · Vendor Advisory