CVE-2023-35789
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
An issue was discovered in the C AMQP client library (aka rabbitmq-c) through 0.13.0 for RabbitMQ, allowing credentials to be entered only on the command line. This makes credentials visible to local attackers by listing a process and its arguments.
Risk Assessment
Local attackers may gain access to sensitive credentials, potentially leading to unauthorized access to the system or data.
Recommendation
It is recommended to avoid entering credentials on the command line and to use alternative authentication methods, such as configuration files with appropriate permissions.
Original NVD description (English source)
An issue was discovered in the C AMQP client library (aka rabbitmq-c) through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line (e.g., for amqp-publish or amqp-consume) and are thus visible to local attackers by listing a process and its arguments.