Cross-site scripting in RabbitMQ - CVE-2021-32718

Vulnerability identifier: #VU54450

CSH Severity: Low

CVSS v4: 2.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2021-32718

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

RabbitMQ
Red Hat OpenStack
Arch Linux
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Module for Server Applications
Server Applications Module
openSUSE Leap
Ubuntu
elixir115
elixir115-doc
rabbitmq-server (Red Hat package)
rabbitmq-server (Ubuntu package)
rabbitmq-server
erlang-rabbitmq-client
rabbitmq-server-plugins
rabbitmq-server313-zsh-completion
rabbitmq-server313-bash-completion
rabbitmq-server313
erlang-rabbitmq-client313
rabbitmq-server313-plugins
erlang26-wx-debuginfo
erlang26-dialyzer
erlang26
erlang26-wx
erlang26-doc
erlang26-dialyzer-src
erlang26-wx-src
erlang26-observer-src
erlang26-debugsource
erlang26-debugger-src
erlang26-src
erlang26-diameter-src
erlang26-observer
erlang26-epmd-debuginfo
erlang26-jinterface
erlang26-et
erlang26-reltool
erlang26-debuginfo
erlang26-et-src
erlang26-reltool-src
erlang26-jinterface-src
erlang26-epmd
erlang26-diameter
erlang26-dialyzer-debuginfo
erlang26-debugger

Install updates from vendor's website.

RabbitMQ - update to 3.8.17
elixir115 - update to 1.15.7-150300.7.5.1
elixir115-doc - update to 1.15.7-150300.7.5.1
rabbitmq-server (Red Hat package) - addressed in versions 3.7.23-9.el8ost, 3.8.16-3.el8ost
rabbitmq-server (Ubuntu package) - update to 3.8.3-0ubuntu0.2
rabbitmq-server - update to 3.8.3-3.3.4
erlang-rabbitmq-client - update to 3.8.3-3.3.4
rabbitmq-server-plugins - update to 3.8.3-3.3.4
rabbitmq-server313-zsh-completion - update to 3.13.1-150600.13.5.3
rabbitmq-server313-bash-completion - update to 3.13.1-150600.13.5.3
rabbitmq-server313 - update to 3.13.1-150600.13.5.3
erlang-rabbitmq-client313 - update to 3.13.1-150600.13.5.3
rabbitmq-server313-plugins - update to 3.13.1-150600.13.5.3
Red Hat OpenStack - addressed in versions 16.1.9, 16.2.4
erlang26-wx-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-dialyzer - update to 26.2.1-150300.7.5.1
erlang26 - update to 26.2.1-150300.7.5.1
erlang26-wx - update to 26.2.1-150300.7.5.1
erlang26-doc - update to 26.2.1-150300.7.5.1
erlang26-dialyzer-src - update to 26.2.1-150300.7.5.1
erlang26-wx-src - update to 26.2.1-150300.7.5.1
erlang26-observer-src - update to 26.2.1-150300.7.5.1
erlang26-debugsource - update to 26.2.1-150300.7.5.1
erlang26-debugger-src - update to 26.2.1-150300.7.5.1
erlang26-src - update to 26.2.1-150300.7.5.1
erlang26-diameter-src - update to 26.2.1-150300.7.5.1
erlang26-observer - update to 26.2.1-150300.7.5.1
erlang26-epmd-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-jinterface - update to 26.2.1-150300.7.5.1
erlang26-et - update to 26.2.1-150300.7.5.1
erlang26-reltool - update to 26.2.1-150300.7.5.1
erlang26-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-et-src - update to 26.2.1-150300.7.5.1
erlang26-reltool-src - update to 26.2.1-150300.7.5.1
erlang26-jinterface-src - update to 26.2.1-150300.7.5.1
erlang26-epmd - update to 26.2.1-150300.7.5.1
erlang26-diameter - update to 26.2.1-150300.7.5.1
erlang26-dialyzer-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-debugger - update to 26.2.1-150300.7.5.1

• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c3hj-rg5h-2772
• https://github.com/rabbitmq/rabbitmq-server/pull/3028

• Cross-site scripting in RabbitMQ
• Arch Linux update for rabbitmq
• SUSE Linux Enterprise Module for Server Applications update for rabbitmq-server
• SUSE update for rabbitmq-server
• Red Hat OpenStack Platform 16.2 update for rabbitmq-server
• Red Hat OpenStack Platform 16.1 update for rabbitmq-server
• SUSE update for Feature update for rabbitmq-server313, erlang26, elixir115
• Ubuntu update for rabbitmq-server