CVE-2021-32718

NameCVE-2021-32718
DescriptionRabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `<script>` tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The vulnerability is patched in RabbitMQ 3.8.17. As a workaround, disable `rabbitmq_management` plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitylow
Debian Bugs990524

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rabbitmq-server (PTS)stretch3.6.6-1fixed
stretch (security)3.6.6-1+deb9u2fixed
buster3.7.8-4vulnerable
bullseye3.8.9-3vulnerable
bookworm, sid3.9.4-1.2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
rabbitmq-serversourcestretch(not affected)
rabbitmq-serversource(unstable)(unfixed)990524

Notes

[bullseye] - rabbitmq-server <no-dsa> (Minor issue)
[buster] - rabbitmq-server <no-dsa> (Minor issue)
[stretch] - rabbitmq-server <not-affected> (Vulnerable code not present)
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c3hj-rg5h-2772
https://github.com/rabbitmq/rabbitmq-server/pull/3028

Search for package or bug name: Reporting problems