CVE Vulnerability Catalog

RabbitMQ versions from 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3 contain a Stored XSS vulnerability in the stream-management UI. The TLS peer-certificate DN is rendered without escaping, allowing injection of malicious HTML/JavaScript. This requires a non-default configuration with a stream TLS listener using verifypeer and an attacker-obtainable trusted certificate with a malicious DN.

RabbitMQ versions from 4.2.0 until 4.2.8 and 4.3.2 had set_token_auth/2 inserting a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping. This allowed attacker-controlled token content to execute JavaScript in the management UI origin. The endpoint is exposed before authentication only when management.oauth_enabled is true, and exploitation through the cookie path additionally requires the attacker to plant an access_token cookie on the management host.

RabbitMQ versions 4.2.0 to 4.2.8 and 4.3.2 contain a vulnerability in get_auth_mechanism/1, which uses term_to_binary/1 on the strict_auth_mechanism or preferred_auth_mechanism atom when clearing the corresponding cookie. This produces a non-ASCII cookie name that violates RFC 6265 and can prevent the browser from deleting the preference. The issue is not directly exploitable for code execution but affects the persistence of preferences across logout and login cycles.

The Web STOMP WebSocket handler in RabbitMQ enforces neither max_frame_size nor login_timeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small frames and accumulate unbounded pre-authentication state. The rabbitmq_web_stomp plugin must be enabled.

RabbitMQ versions from 4.0.0 until 4.0.22, 4.1.14, 4.2.7, and 4.3.1 are vulnerable to atom exhaustion. The toatom/1 function is called on the :name URL path segment in global-parameters endpoints, allowing a user with the policymaker tag to send repeated requests and exhaust the atom table, crashing the node.

RabbitMQ versions from 4.0.0 until 4.0.22, 4.1.14, and 4.2.7 are vulnerable to admin-only atom exhaustion. The settags/2 function calls toatom/1 on the user's tags list, and the 20 MB body limit allows approximately 3-4 million short tags. An administrator can crash the node with a single request.

RabbitMQ versions from 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6 have a vulnerability in the stream protocol where the FrameMax value negotiated during the Tune handshake is stored but not compared with an inbound frame's declared length before buffering. A remote client can cause excessive memory pressure and denial of service by declaring an oversized frame.

RabbitMQ versions in the 3.13, 4.0, 4.1, 4.2, and 4.3 lines have a vulnerability where fill/2 substitutes ${username} into user_dn_pattern without RFC 4514 DN escaping, allowing a crafted username to alter the LDAP bind DN. Exploitation requires rabbitmq_auth_backend_ldap with a user_dn_pattern containing ${username}, a suitable directory layout, and a valid password. Fixed versions are conflicting across sources.

RabbitMQ versions 3.13.0 through 3.13.15, 4.0.20, 4.1.11, and 4.2.6 have a vulnerability where list_to_atom/1 is applied to every colon-delimited token in an attacker-controlled auth_mechanism value, permanently consuming Erlang VM atoms and allowing the node to be crashed with a large request. Exploitation requires the Shovel or Federation plugin to be in use and the policymaker tag.

RabbitMQ versions from 3.13.0 to 3.13.15, 4.0.20, 4.1.11, and 4.2.6 contain a vulnerability allowing bypass of the 'protected' tag via bulk-delete. An administrator can delete protected service accounts using the bulk endpoint, bypassing the safeguard that checks the protected tag.

RabbitMQ versions 3.13.0 through 3.13.15, 4.0.20, 4.1.11, and 4.2.6 are vulnerable to atom table exhaustion via the node field in the management API. The PUT /api/queues/:vhost/:name (and exchanges and bindings endpoints) accepts a node JSON field that is converted to an atom without cluster membership check. Each unique value permanently leaks one atom, and roughly 900K requests crash the VM.

RabbitMQ versions 3.13.0 through 3.13.15, 4.0.22, 4.1.11, 4.2.6, and 4.3.1 are vulnerable to atom exhaustion via OAuth2 JWT tag scope values. The extractscopes/1 function parses scopes of the form .tag: and converts them to atoms. The token signature is verified, but in IdP configurations where scope content is user-influenced, each login with a novel tag value leaks one atom.

RabbitMQ versions 4.0.0 through 4.3.3, 4.2.9, 4.1.14, and 4.0.23 have a vulnerability in AMQP 1.0 where the GET /bindings management endpoint exposes full binding topology to any authenticated AMQP user without resource/management permission checks. Unlike other operations in the same module, GET /bindings does not check permissions and returns the binding list unchanged.

Zammad prior to version 7.0.2 has a vulnerability that allows a user with editor rights in one knowledge base category to see answer titles and updated_at timestamps from categories they do not have access to, via the global quick search. Category names are not leaked, but titles may disclose sensitive information.

Zammad before version 7.0.2 has an issue with permission checks in the knowledge base management area. Under certain conditions, data validation for linked items was not fully enforced, potentially allowing users with limited read permissions to interact with items outside their assigned access scope.

Zammad before version 7.0.2 allows a customer who can view a ticket to not see internal ticket articles through the article listing API, but the same customer can directly request an attachment belonging to an internal article via the attachment download endpoint, bypassing article-level authorization. The attachment download only checks the parent ticket, not the article, so the same customer can download the attachment directly.

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script when rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or JavaScript context encoding, a crafted metadata value can break out of the intended URL structure and inject script content.

Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced devices when the malicious document is opened.

The Rattadan Cosmowarp smart contract before version 56c6147 can have a comparison to an unintended value of current_admin. This may lead to incorrect contract logic behavior.