PT-2024-35078 · Rabbitmq+1 · Rabbitmq+1

Anhanhnguyen + 1 · Published 2024-11-06 · Updated 2024-11-08 · CVE-2024-51988

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.12.11 RabbitMQ Tanzu versions prior to 1.5.2 RabbitMQ Tanzu versions prior to 3.13.0 RabbitMQ Tanzu versions prior to 4.0.0

Description RabbitMQ is a feature-rich, multi-protocol messaging and streaming broker. In affected versions, queue deletion via the HTTP API was not verifying the configure permission of the user. Users who had valid credentials, some permissions for the target virtual host, and HTTP API access could delete queues they had no deletion permissions for. This issue has been addressed in version 3.12.11 of the open source RabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the Tanzu release.

Recommendations For RabbitMQ versions prior to 3.12.11, upgrade to version 3.12.11 or later. For RabbitMQ Tanzu versions prior to 1.5.2, upgrade to version 1.5.2 or later. For RabbitMQ Tanzu versions prior to 3.13.0, upgrade to version 3.13.0 or later. For RabbitMQ Tanzu versions prior to 4.0.0, upgrade to version 4.0.0 or later. As a temporary workaround, consider disabling the management plugin and using, for example, Prometheus and Grafana for monitoring.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BIT-RABBITMQ-2024-51988

CVE-2024-51988

GHSA-PJ33-75X5-32J4

Affected Products

Rabbitmq

Tanzu Rabbitmq

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51988.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-51988 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-51988 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51988 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-51988 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-51988 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-51988 · Security Note
• https://osv.dev/vulnerability/GHSA-pj33-75x5-32j4 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-rabbitmq-2024-51988 · Vendor Advisory
• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj33-75x5-32j4 · Note
• https://github.com/rabbitmq/rabbitmq-server · Note
• https://t.me/cvenotify/101122 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1854386052166783463 · Twitter Post
• https://t.me/cvedetector/10038 · Telegram Post
• https://twitter.com/CVEnew/status/1854244159810412622 · Twitter Post