UpHeron
All vulnerabilities

Servers and applications

CVE-2021-32719

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ federation management plugin

Severity
Medium 4.8
Published
27 Jun 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.8.18
Also known as
GHSA-5452-hxj4-773x
Sources
NVD, Project advisories (GitHub)

Description

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the `rabbitmq_federation_management` plugin, its consumer tag was rendered without proper <script> tag sanitization. This potentially allows for JavaScript code execution in the context of the page. The user must be signed in and have…

Affected software

SoftwareAffected versions
RabbitMQServers and applications · cpe:a:vmware:rabbitmq
  • Every version before 3.8.18
RabbitMQServers and applications · github:rabbitmq/rabbitmq-server
  • Every version before 3.8.18

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-32719
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-32719
  • GitHub Advisory Database https://github.com/advisories/GHSA-5452-hxj4-773x
  • github.com https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5452-hxj4-773x