Skip to content
Fencer Vulns
low 2.4

CVE-2019-11281 json

RabbitMQ XSS attack

published 2019-10-16 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-2969

cvss
2.4
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack that would gain access to virtual hosts and policy management information.

Patch / fix

  • pivotal_software rabbitmq 1.15.13, 1.16.6, 1.17.3, 3.7.18
  • rabbitmq-server Debian 14, Debian 13, Debian 12 3.7.18-1

debian advisories DEBIAN-CVE-2019-11281

  • rabbitmq-server openstack 15 3.7.22-1.el8ost

red hat advisories RHSA-2020:0078

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-11281 updated cvss 4.9

rabbitmq-server: improper sanitization of vhost limits and federation management UI pages

  • Red Hat OpenStack Platform 10 (Newton) rabbitmq-server Red Hat OpenStack Platform 13 (Queens) rabbitmq-server Red Hat OpenStack Platform 14 (Rocky) rabbitmq-server
    affected: workaround, no fix planned “There is no mitigation for this issue, the flaw can only be resolved by applying updates.”
  • Red Hat OpenStack Platform 15.0 rabbitmq-server 3.7.22-1.el8ost
    fixed: vendor fix “There is no mitigation for this issue, the flaw can only be resolved by applying updates.” RHSA-2020:0078
  • Red Hat CloudForms Management Engine 5 rabbitmq-server Red Hat Ansible Tower 3 rabbitmq-server
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.17% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 2.4 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
NVD 3.1 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected products

  • Pivotal RabbitMQ
  • Pivotal RabbitMQ for PCF

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.