| Package | Affected versions | Patched versions |
|---|---|---|
| rabbitmq server | ≥ 3.13.0, < 4.2.5 | 4.2.5 |
RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_federation_management plugin renders the consumer_tag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute JavaScript in the browser of a user viewing that page. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free