CVE-2017-4966

high-risk

Published 2017-06-13

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user credentials in a browser's local storage without expiration, making it possible to retrieve them using a chained attack.

Do I need to act?

0.19% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.8/10 High

LOCAL / LOW complexity

Affected Products (20)

Rabbitmq Server

Rabbitmq

Affected Vendors

Broadcom Pivotal Software Debian

References (4)

Third Party Advisory https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html

Mitigation https://pivotal.io/security/cve-2017-4966

Third Party Advisory https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html

Mitigation https://pivotal.io/security/cve-2017-4966

/ 100

high-risk

Severity 24/34 · High

Exploitability 1/34 · Minimal

Exposure 28/34 · Critical