CVE-2017-4965

high-risk

Published 2017-06-13

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ management UI are vulnerable to XSS attacks.

Do I need to act?

0.72% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.1/10 Medium

NETWORK / LOW complexity

Affected Products (20)

Rabbitmq Server

Rabbitmq

Affected Vendors

Pivotal Software Debian Broadcom

References (6)

Third Party Advisory http://www.securityfocus.com/bid/98394

Third Party Advisory https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html

Mitigation https://pivotal.io/security/cve-2017-4965

Third Party Advisory http://www.securityfocus.com/bid/98394

Third Party Advisory https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html

Mitigation https://pivotal.io/security/cve-2017-4965

/ 100

high-risk

Severity 23/34 · High

Exploitability 2/34 · Minimal

Exposure 28/34 · Critical