CVE-2017-4966

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user credentials in a browser's local storage without expiration, making it possible to retrieve them using a chained attack.

Score

CVSS 3.1 7.8 High

Status

Modified - security_alert@emc.com

Published

2017-06-13

Last modified

2024-08-05

Weaknesses

CWE-200

Affected products

• Rabbitmq Server (Broadcom)
• Debian Linux (Debian)
• Rabbitmq (Pivotal Software)

References

• https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html
• https://pivotal.io/security/cve-2017-4966