CVE-2014-9649
Fixed in a distro release EPSS 2%
Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.
Products: broadcom rabbitmq_server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rabbitmq-server | 3.4.1-1 |
| Debian 13 | rabbitmq-server | 3.4.1-1 |
| Debian 14 | rabbitmq-server | 3.4.1-1 |
| Red Hat openstack 5 | rabbitmq-server | 0:3.1.5-6.1.el6ost |
| Red Hat openstack 5 | rabbitmq-server | 0:3.3.5-18.el7ost |
| Red Hat openstack 6 | rabbitmq-server | 0:3.3.5-18.el7ost |
| Red Hat openstack 7 | rabbitmq-server | 0:3.3.5-18.el7ost |