QwikSec

Security Database

CVE

CWE

Training

CVE-2019-11287

Published: Nov 22, 2019

Modified: Sep 16, 2024

PUBLISHED

CVSS v3.0

4.5

MEDIUM

Description

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.

Vendor	Product	Versions
Pivotal	RabbitMQ for Pivotal Platform	affected `1.16 - < 1.16.7` affected `1.17 - < 1.17.4`
Pivotal	RabbitMQ	affected `3.7 - < v3.7.21` affected `3.8 - < v3.8.1`

Weaknesses (CWE)

CVSS v3.0 Details

CVSS v3.0 Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

References

https://pivotal.io/security/cve-2019-11287

x_refsource_CONFIRM

FEDORA-2019-6497f51791

vendor-advisory

x_refsource_FEDORA

FEDORA-2019-74d2feb5be

vendor-advisory

x_refsource_FEDORA

vendor-advisory

x_refsource_REDHAT

https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-11287-DoS%20via%20Heap%20Overflow-RabbitMQ%20Web%20Management%20Plugin

x_refsource_MISC

[debian-lts-announce] 20210719 [SECURITY] [DLA 2710-1] rabbitmq-server security update

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.