RabbitMQ fixes 1 vulnerability

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] RabbitMQ fixes 1 vulnerability

RabbitMQ fixes 1 vulnerability in RabbitMQ and Tanzu RabbitMQ. The vulnerability is fixed in version 3.12.11 for RabbitMQ and in versions 1.5.2, 3.13.0 and 4.0.0 for Tanzu RabbitMQ [1].

RabbitMQ - unauthorized deletion (CVE-2024-51988)

CVSS 6.5 (Medium)

An authenticated remote attacker can delete queues without authorization, which may cause information loss and a DoS attack on applications that depend on this service. To exploit the vulnerability, the attacker needs access to the HTTP API and at least some privileges on the affected machine. As a temporary fix, the management plugin can be disabled and monitoring tools such as Prometheus or Grafana used instead [1].

The vulnerability is present in products:

RabbitMQ; > 3.12.7, < 3.12.11;
Tanzu RabbitMQ; < 1.5.2; >= 3.0, < 3.13.0;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

More information:

CVE-2024-51988 at cve.org, NVD
CWE-284: Improper Access Control at cwe.mitre.org

The vulnerability was publicly disclosed 6. 11. 2024.

Report feedback

[TLP:CLEAR] RabbitMQ fixes 1 vulnerability

RabbitMQ - unauthorized deletion (CVE-2024-51988)

CVSS 6.5 (Medium)

Links