An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user credentials in a browser's local storage without expiration, making it possible to retrieve them using a chained attack.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and     3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions     prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user     credentials in a browser's local storage without expiration, making it possible to retrieve them using a     chained attack. (CVE-2017-4966)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by a vulnerability as referenced in the USN-6265-1 advisory.

    It was discovered that RabbitMQ incorrectly handled certain signed-in user credentials. An attacker could     possibly use this issue to expose sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-2710 advisory.

  - An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and     3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions     prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ management UI are     vulnerable to XSS attacks. (CVE-2017-4965, CVE-2017-4967)

  - An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and     3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions     prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user     credentials in a browser's local storage without expiration, making it possible to retrieve them using a     chained attack. (CVE-2017-4966)

  - Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13,     versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual     host limits page, and the federation management UI, which do not properly sanitize user input. A remote     authenticated malicious user with administrative access could craft a cross site scripting attack that     would gain access to virtual hosts and policy management information. (CVE-2019-11281)

  - Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal     Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management     plugin that is vulnerable to a denial of service attack. The X-Reason HTTP Header can be leveraged to     insert a malicious Erlang format string that will expand and consume the heap, resulting in the server     crashing. (CVE-2019-11287)

  - RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input     validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by     sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.
    (CVE-2021-22116)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the version of Pivotal RabbitMQ running on the remote web server is 3.4.x, 3.5.x, or 3.6.x prior to 3.6.9. It is, therefore, affected by multiple vulnerabilities :

  - Multiple cross-site scripting (XSS) vulnerabilities     exist in the Management user interface due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit these, via a specially     crafted request, to execute arbitrary script code in     a user's browser session. (CVE-2017-4965, CVE-2017-4967)

  - An information disclosure vulnerability exists in     credential caching due to credentials being cached     locally in the browser and not expiring. A local     attacker can exploit this, via a chained attack, to     disclose user credentials. (CVE-2017-4966)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
221088	Linux Distros Unpatched Vulnerability : CVE-2017-4966	Nessus	Misc.	high
179063	Ubuntu 16.04 ESM : RabbitMQ vulnerability (USN-6265-1)	Nessus	Ubuntu Local Security Checks	high
152075	Debian DLA-2710-1 : rabbitmq-server - LTS security update	Nessus	Debian Local Security Checks	high
100296	Pivotal RabbitMQ Management Plugin 3.4.x / 3.5.x / 3.6.x < 3.6.9 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2017-4966

high

Tenable Plugins

high

high

high

medium