Every CVE Search/ Get API key

CVE-2019-11291

RabbitMQ XSS attack via federation and shovel endpoints

3.1 LowFix available

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
High
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.80%Unchanged since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 3.1

RabbitMQ XSS attack via federation and shovel endpoints

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.

Record
CVE-2019-11291
CVSS 3.0
3.1 LowCVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2022-3419 3.1

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.

Record
EUVD-2022-3419
CVSS 3.0
3.1 LowCVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-9pf7-f47q-mwpq 3.5

Cross-site Scripting in RabbitMQ

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.

Record
GHSA-9pf7-f47q-mwpq
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 4.8

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.

Record
CVE-2019-11291
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS 3.0
3.1 LowCVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 4.8

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.

Record
CVE-2019-11291
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2019-11291 4.8

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.

Record
DEBIAN-CVE-2019-11291
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVGHSA-9pf7-f47q-mwpq 3.5

Cross-site Scripting in RabbitMQ

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.

Record
GHSA-9pf7-f47q-mwpq
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVRHSA-2020:0553 3.1

Red Hat Security Advisory: rabbitmq-server security update

Record
RHSA-2020:0553
CVSS 3.0
3.1 LowCVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2019-11291 4.8

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.

Record
UBUNTU-CVE-2019-11291
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS 3.0
3.1 LowCVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rabbit_common
Hex
 3.7.0 up to 3.7.20
3.7.20
rabbit_common
Hex
 3.8.0 up to 3.8.1
3.8.1
rabbitmq-server
Debian:12
 before 3.8.3-1
3.8.3-1
rabbitmq-server
Debian:13
 before 3.8.3-1
3.8.3-1
rabbitmq-server
Debian:14
 before 3.8.3-1
3.8.3-1
rabbit_common
Hex
 3.7.0 up to 3.7.20, plus listed versions
3.7.13.7.10-rc.13.7.10-rc.23.7.10-rc.33.7.10-rc.4
Show 45 moreShow less
3.7.113.7.11-rc.13.7.11-rc.23.7.123.7.12-rc.13.7.12-rc.23.7.133.7.13-rc.13.7.13-rc.23.7.143.7.14-rc.13.7.14-rc.23.7.153.7.163.7.16-beta.13.7.16-rc.13.7.16-rc.23.7.16-rc.33.7.16-rc.43.7.173.7.17-rc.13.7.17-rc.23.7.17-rc.33.7.183.7.18-rc.13.7.193.7.23.7.20-rc.13.7.20-rc.23.7.33.7.3-rc.13.7.3-rc.23.7.43.7.4-rc.13.7.4-rc.23.7.4-rc.33.7.4-rc.43.7.53.7.5-rc.13.7.63.7.6-rc.13.7.6-rc.23.7.73.7.7-rc.13.7.7-rc.2
3.7.20
rabbit_common
Hex
 3.8.0 up to 3.8.1, plus listed versions
3.8.1-rc.1
3.8.1
rabbitmq-server
Red Hat:openstack:15::el8
 before 0:3.7.23-2.el8ost
0:3.7.23-2.el8ost

History

History
RecordedChangedSources
affected
aliases, products, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-11291 is a low vulnerability (CVSS 3.1) in Pivotal Rabbitmq, published November 22, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. Fixed in rabbit_common 3.7.20.

References

Show 7 moreShow less
This page doesn't list everything

Left out here: 8 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open