{"id":"CVE-2014-9649","aliases":["DEBIAN-CVE-2014-9649","EUVD-2014-9459","GHSA-3ppr-6h5r-qm4p","MGASA-2015-0240","RHSA-2016:0308","RHSA-2016:0367","RHSA-2016:0368","RHSA-2016:0369"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x...","description":"Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02313,"percentile":0.83516,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2015-01-27T17:00:00Z","modified":"2026-10-23T15:47:33Z","fixes":[{"ecosystem":"Debian:12","package":"rabbitmq-server","fixed_in":["3.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rabbitmq-server","fixed_in":["3.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rabbitmq-server","fixed_in":["3.4.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.5-18.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.5-18.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-6.1.el6ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.5-18.el7ost"}]}],"bundled":2}],"products":[{"vendor":"broadcom","product":"rabbitmq_server"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-0308.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/76084","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://groups.google.com/forum/#%21topic/rabbitmq-users/-3Z2FyGtXhs","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.rabbitmq.com/release-notes/README-3.4.1.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/01/21/13","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9649","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/rabbitmq-users/-3Z2FyGtXhs","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3ppr-6h5r-qm4p"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9649","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0240.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15120","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2015/01/27/8","tags":["web"]},{"url":"http://www.rabbitmq.com/news.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0308","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185514","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185515","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1303747","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0308.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9649","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9649","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9650","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9650","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9650","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0367","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0367.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0368","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0368.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0369","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1303748","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0369.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2014-9649","description":"Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.","status":"published","published":"2015-01-27T17:00:00Z","modified":"2024-08-06T13:47:41.729Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2014-9459","description":"Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.","status":"published","published":"2015-01-27T17:00:00Z","modified":"2024-08-06T13:47:41Z","updated_at":"2026-11-03T01:56:48.455518Z"}],"ghsa":[{"id":"GHSA-3ppr-6h5r-qm4p","title":"Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x...","description":"Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.","status":"published","published":"2022-05-13T01:03:08Z","modified":"2025-04-02T15:31:28Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:00:36.145205Z"}],"nvd":[{"id":"CVE-2014-9649","description":"Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.","status":"published","published":"2015-01-27T20:02:39.637Z","modified":"2026-06-17T00:18:42.94Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:58.030217Z"}],"osv":[{"id":"CVE-2014-9649","description":"Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.","status":"published","published":"2015-01-27T20:02:39Z","modified":"2026-04-16T06:24:49.107954644Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9649","description":"Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.","status":"published","published":"2015-01-27T20:02:39.637Z","modified":"2026-10-23T15:47:33.770677657Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"MGASA-2015-0240","title":"Updated rabbitmq-server packages fix security vulnerabilities","description":"Updated rabbitmq-server package fixes security vulnerabilities:\n\nRabbitMQ before 3.4.1 does not prevent /api/* from returning text/html error\nmessages which could act as an XSS vector (CVE-2014-9649).\n\nRabbitMQ before 3.4.1 has a response-splitting vulnerability in /api/downloads\n(CVE-2014-9650).\n\nIn RabbitMQ before 3.4.3, some user-controllable content was not properly\nHTML-escaped before being presented to a user in the management web UI.\nAn attacker could publish a specially crafted message, policy name, or client\nversion to execute arbitrary Javascript code on behalf of a user who was\nviewing messages, policies, or connected clients in the management UI. In all\ncases, the attacker needs a valid user account on the targetted RabbitMQ\ncluster (CVE-2015-0862).\n\nThe rabbitmq-server package has been updated to version 3.5.3, fixing these\nissues and several other bugs.\n","status":"published","published":"2015-06-08T21:17:51Z","modified":"2026-04-16T06:24:56.872120441Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"RHSA-2016:0308","title":"Red Hat Security Advisory: rabbitmq-server security and bugfix update","status":"published","published":"2024-09-13T09:23:35Z","modified":"2026-06-29T10:11:36Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0367","title":"Red Hat Security Advisory: rabbitmq-server security and bugfix update","status":"published","published":"2024-09-13T09:23:30Z","modified":"2026-06-29T10:11:47Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0368","title":"Red Hat Security Advisory: rabbitmq-server security update","status":"published","published":"2024-09-13T09:23:46Z","modified":"2026-06-29T10:11:48Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0369","title":"Red Hat Security Advisory: rabbitmq-server security and bug fix update","status":"published","published":"2024-09-13T09:23:40Z","modified":"2026-06-29T10:11:48Z","updated_at":"2026-11-02T15:53:03.734507Z"}]}}