CVE-2014-9649

RabbitMQ 2.1.0-3.4.0 - Cross-Site Scripting via API Path Info

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/76084
Vendor Advisory x_refsource_confirm
http://www.rabbitmq.com/release-notes/README-3.4.1.txt
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/01/21/13
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-0308.html

Scores

EPSS 0.0030
EPSS Percentile 53.1%

Details

CWE
CWE-79
Status published
Products (44)
broadcom/rabbitmq_server 2.1.0
broadcom/rabbitmq_server 2.1.1
broadcom/rabbitmq_server 2.2.0
broadcom/rabbitmq_server 2.3.0
broadcom/rabbitmq_server 2.3.1
broadcom/rabbitmq_server 2.4.0
broadcom/rabbitmq_server 2.4.1
broadcom/rabbitmq_server 2.5.0
broadcom/rabbitmq_server 2.5.1
broadcom/rabbitmq_server 2.6.0
... and 34 more
Published Jan 27, 2015
Tracked Since Feb 18, 2026