Rapid7 Vulnerability & Exploit Database

SUSE: CVE-2021-32718: SUSE Linux Security Advisory

Free InsightVM Trial No Credit Card Necessary
Watch Demo See how it all works
Back to Search

SUSE: CVE-2021-32718: SUSE Linux Security Advisory

Severity
4
CVSS
(AV:N/AC:M/Au:S/C:N/I:P/A:N)
Published
06/28/2021
Created
11/13/2021
Added
11/11/2021
Modified
10/26/2022

Description

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `<script>` tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The vulnerability is patched in RabbitMQ 3.8.17. As a workaround, disable `rabbitmq_management` plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring.

Solution(s)

  • suse-upgrade-erlang-rabbitmq-client
  • suse-upgrade-rabbitmq-server
  • suse-upgrade-rabbitmq-server-plugins

References

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;