title: RabbitMQ XSS attack via federation and shovel endpoints
description: Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.
problem types: CWE-79: Cross-site Scripting (XSS) - Generic
affected:
{
product: RabbitMQ
vendor: Pivotal
versions:
lessThan: v3.8.1, status: affected, version: 3.8, versionType: custom
lessThan: v3.7.20, status: affected, version: 3.7, versionType: custom
}
{
product: RabbitMQ for Pivotal Platform
vendor: Pivotal
versions:
lessThan: 1.17.4, status: affected, version: 1.17, versionType: custom
lessThan: 1.16.7, status: affected, version: 1.16, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
version: 3.0
]