An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ management UI are vulnerable to XSS attacks.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - rabbitmq: MQTT connection authentication succeeds with empty password (CVE-2016-9877)

  - An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and     3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions     prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ management UI are     vulnerable to XSS attacks. (CVE-2017-4965, CVE-2017-4967)

  - An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and     3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions     prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user     credentials in a browser's local storage without expiration, making it possible to retrieve them using a     chained attack. (CVE-2017-4966)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-2710 advisory.

  - An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and     3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions     prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ management UI are     vulnerable to XSS attacks. (CVE-2017-4965, CVE-2017-4967)

  - An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and     3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions     prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user     credentials in a browser's local storage without expiration, making it possible to retrieve them using a     chained attack. (CVE-2017-4966)

  - Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13,     versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual     host limits page, and the federation management UI, which do not properly sanitize user input. A remote     authenticated malicious user with administrative access could craft a cross site scripting attack that     would gain access to virtual hosts and policy management information. (CVE-2019-11281)

  - Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal     Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management     plugin that is vulnerable to a denial of service attack. The X-Reason HTTP Header can be leveraged to     insert a malicious Erlang format string that will expand and consume the heap, resulting in the server     crashing. (CVE-2019-11287)

  - RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input     validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by     sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.
    (CVE-2021-22116)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the version of Pivotal RabbitMQ running on the remote web server is 3.4.x, 3.5.x, or 3.6.x prior to 3.6.9. It is, therefore, affected by multiple vulnerabilities :

  - Multiple cross-site scripting (XSS) vulnerabilities     exist in the Management user interface due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit these, via a specially     crafted request, to execute arbitrary script code in     a user's browser session. (CVE-2017-4965, CVE-2017-4967)

  - An information disclosure vulnerability exists in     credential caching due to credentials being cached     locally in the browser and not expiring. A local     attacker can exploit this, via a chained attack, to     disclose user credentials. (CVE-2017-4966)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199148	RHEL 6 : rabbitmq-server (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
152075	Debian DLA-2710-1 : rabbitmq-server - LTS security update	Nessus	Debian Local Security Checks	high
100296	Pivotal RabbitMQ Management Plugin 3.4.x / 3.5.x / 3.6.x < 3.6.9 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2017-4967

medium

Tenable Plugins

critical

high

medium