---

CVE-2021-32719 - log back

CVE-2021-32719 edited at 06 Jul 2021 09:17:44
Description	In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the rabbitmq_federation_management plugin, its consumer tag was rendered without proper <script> tag sanitization, potentially allowing for JavaScript code execution in the context of the page. - - As a workaround, disable the rabbitmq_management plugin and use CLI tools instead.

CVE-2021-32719 edited at 28 Jun 2021 16:05:50
Severity	- Unknown + Low
Remote	- Unknown + Remote
Type	- Unknown + Cross-site scripting
Description	+ In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the rabbitmq_federation_management plugin, its consumer tag was rendered without proper <script> tag sanitization, potentially allowing for JavaScript code execution in the context of the page. + + As a workaround, disable the rabbitmq_management plugin and use CLI tools instead.
References	+ https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5452-hxj4-773x + https://github.com/rabbitmq/rabbitmq-server/pull/3122 + https://github.com/rabbitmq/rabbitmq-server/commit/08beb82e9ab8923ded88ece2800cd80971e2bd05
Notes	+ Workaround + ========== + + As a workaround, disable the rabbitmq_management plugin and use CLI tools instead.

CVE-2021-32719 created at 28 Jun 2021 16:02:23
Severity	+ Unknown
Remote	+ Unknown
Type	+ Unknown
Description
References
Notes