CVE-2014-9494
RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a...
RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a crafted X-Forwareded-For header.
Exploit likelihood
What each source reports
NVD Score used
RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a crafted X-Forwareded-For header.
- Record
CVE-2014-9494- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a crafted X-Forwareded-For header.
- Record
CVE-2014-9494- Updated
- 2026-11-02
EUVDEUVD-2014-9311 No score
RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a crafted X-Forwareded-For header.
- Record
EUVD-2014-9311- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rgxx-9mfj-x5rf No score
RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a...
RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a crafted X-Forwareded-For header.
- Record
GHSA-rgxx-9mfj-x5rf- Updated
- 2026-11-02
OSV No score
RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a crafted X-Forwareded-For header.
- Record
CVE-2014-9494- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9494 No score
RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a crafted X-Forwareded-For header.
- Record
DEBIAN-CVE-2014-9494- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10370-1 No score
erlang-rabbitmq-client-3.5.4-1.4 on GA media
These are all security issues fixed in the erlang-rabbitmq-client-3.5.4-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10370-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-9494 No score
RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a crafted X-Forwareded-For header.
- Record
UBUNTU-CVE-2014-9494- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rabbitmq-serverDebian:12 |
before 3.4.1-1 | 3.4.1-1 |
rabbitmq-serverDebian:13 |
before 3.4.1-1 | 3.4.1-1 |
rabbitmq-serverDebian:14 |
before 3.4.1-1 | 3.4.1-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9494 is a medium vulnerability (CVSS 5.0) in Pivotal Software Rabbitmq, published January 20, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.39%, the 72nd percentile. Fixed in rabbitmq-server 3.4.1-1.