| Package | Affected versions | Patched versions |
|---|---|---|
| rabbitmq server | = 3.4.0= 3.4.1= 3.4.2= 3.4.3= 3.4.4= 3.5.0= 3.5.1= 3.5.2= 3.5.3= 3.5.6= 3.6.7 | |
| rabbitmq | = 1.5.0= 1.5.1= 1.5.10= 1.5.11= 1.5.12= 1.5.13= 1.5.14= 1.5.15= 1.5.17= 1.5.18= 1.5.19= 1.5.2= 1.5.3= 1.5.4= 1.5.5= 1.5.6= 1.5.7= 1.5.8= 1.5.9= 1.6.0= 1.6.1= 1.6.10= 1.6.12= 1.6.13= 1.6.14= 1.6.15= 1.6.16= 1.6.2= 1.6.3= 1.6.4= 1.6.5= 1.6.6= 1.6.7= 1.6.8= 1.6.9= 1.7.0= 1.7.10= 1.7.13= 1.7.14= 1.7.2= 1.7.3= 1.7.4= 1.7.5= 1.7.6= 1.7.7= 1.7.8= 1.7.9= 3.5.4= 3.5.5= 3.5.7= 3.6.0= 3.6.1= 3.6.2= 3.6.3= 3.6.4= 3.6.5= 3.6.6 |
An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user credentials in a browser's local storage without expiration, making it possible to retrieve them using a chained attack.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free