CVE-2014-9649
Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x...
Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.
- Record
CVE-2014-9649- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.
- Record
CVE-2014-9649- Updated
- 2026-11-02
EUVDEUVD-2014-9459 No score
Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.
- Record
EUVD-2014-9459- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3ppr-6h5r-qm4p No score
Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x...
Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.
- Record
GHSA-3ppr-6h5r-qm4p- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.
- Record
CVE-2014-9649- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9649 No score
Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.
- Record
DEBIAN-CVE-2014-9649- Updated
- 2026-11-02
OSVMGASA-2015-0240 No score
Updated rabbitmq-server packages fix security vulnerabilities
Updated rabbitmq-server package fixes security vulnerabilities:
RabbitMQ before 3.4.1 does not prevent /api/* from returning text/html error messages which could act as an XSS vector (CVE-2014-9649).
RabbitMQ before 3.4.1 has a response-splitting vulnerability in /api/downloads (CVE-2014-9650).
In RabbitMQ before 3.4.3, some user-controllable content was not properly HTML-escaped before being presented to a user in the management web UI. An attacker could publish a specially crafted message, policy name, or client version to execute arbitrary Javascript code on behalf of a user who was viewing messages, policies, or connected clients in the management UI. In all cases, the attacker needs a valid user account on the targetted RabbitMQ cluster (CVE-2015-0862).
The rabbitmq-server package has been updated to version 3.5.3, fixing these issues and several other bugs.
- Record
MGASA-2015-0240- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rabbitmq-serverDebian:12 |
before 3.4.1-1 | 3.4.1-1 |
rabbitmq-serverDebian:13 |
before 3.4.1-1 | 3.4.1-1 |
rabbitmq-serverDebian:14 |
before 3.4.1-1 | 3.4.1-1 |
rabbitmq-serverMageia:4 From an advisory covering 3 CVEs |
before 3.5.3-1.mga4 | 3.5.3-1.mga4 |
rabbitmq-serverRed Hat:openstack:6::el7 From an advisory covering 2 CVEs |
before 0:3.3.5-18.el7ost | 0:3.3.5-18.el7ost |
rabbitmq-serverRed Hat:openstack:7::el7 From an advisory covering 2 CVEs |
before 0:3.3.5-18.el7ost | 0:3.3.5-18.el7ost |
rabbitmq-serverRed Hat:openstack:5::el6 From an advisory covering 2 CVEs |
before 0:3.1.5-6.1.el6ost | 0:3.1.5-6.1.el6ost |
rabbitmq-serverRed Hat:openstack:5::el7 From an advisory covering 2 CVEs |
before 0:3.3.5-18.el7ost | 0:3.3.5-18.el7ost |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9649 is a medium vulnerability (CVSS 4.3) in Broadcom Rabbitmq Server, published January 27, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.31%, the 83rd percentile. Fixed in rabbitmq-server 3.4.1-1.
References
rhn.redhat.com/errata/RHSA-2016-0308.html
securityfocus.com/bid/76084
groups.google.com/forum
rabbitmq.com/release-notes/README-3.4.1.txt
openwall.com/lists/oss-security/2015/01/21/13
nvd.nist.gov/vuln/detail/CVE-2014-9649
Show 24 moreShow less
github.com/advisories/GHSA-3ppr-6h5r-qm4p
security-tracker.debian.org/tracker/CVE-2014-9649
advisories.mageia.org/MGASA-2015-0240.html
bugs.mageia.org/show_bug.cgi?id=15120
openwall.com/lists/oss-security/2015/01/27/8
access.redhat.com/errata/RHSA-2016:0308
bugzilla.redhat.com/show_bug.cgi?id=1185514
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0308.json
cve.org/CVERecord?id=CVE-2014-9649