VULNERABILITY

Ubuntu: USN-7143-1 (CVE-2021-32718): RabbitMQ Server vulnerabilities

Try Surface Command Get a continuous 360° view of your attack surface
Back to Search

Ubuntu: USN-7143-1 (CVE-2021-32718): RabbitMQ Server vulnerabilities

Severity
4
CVSS
(AV:N/AC:M/Au:S/C:N/I:P/A:N)
Published
06/28/2021
Created
12/11/2024
Added
12/10/2024
Modified
12/10/2024

Description

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `<script>` tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The vulnerability is patched in RabbitMQ 3.8.17. As a workaround, disable `rabbitmq_management` plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring.

Solution(s)

  • ubuntu-upgrade-rabbitmq-server

References

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
  • Lightweight Endpoint Agent
  • Live Dashboards
  • Real Risk Prioritization
  • IT-Integrated Remediation Projects
  • Cloud, Virtual, and Container Assessment
  • Integrated Threat Feeds
  • Easy-to-Use RESTful API
  • Automation-Assisted Patching
  • Automated Containment
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;