CVE Vulnerability Catalog

IBM Concert versions 1.0.0 through 3.0.0 is vulnerable to improper access control, allowing unauthorized modification of application files.

RabbitMQ before versions 4.2.7 and 4.3.1 does not enforce an explicit match limit when compiling LIKE patterns into regular expressions, allowing an authenticated AMQP 1.0 consumer with read and write permissions on a stream queue to cause significant CPU consumption via a crafted LIKE filter. Each delivered message can cause about 100-200 ms of CPU load, amplified across thousands of messages and parallel sessions. The issue is fixed in versions 4.2.7 and 4.3.1.

RabbitMQ prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15 stores the content-header BodySize (a uint64) without validation against max_message_size. A client can declare body_size = 2^63-1 and stream fragments so the size check never fires, causing the reader process to accumulate unbounded memory. This leads to node memory exhaustion or a memory alarm, degrading all publishers cluster-wide.

RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 calls rabbit_data_coercion:atomize_keys/1 (the unsafe binary_to_atom variant) on the vhost metadata map. An administrator importing a crafted definitions file can exhaust the atom table and crash the node in a single request.

RabbitMQ prior to versions 4.2.7 and 4.3.1 coerces the URL :component segment to an atom via rabbit_data_coercion:to_atom/1 in the runtime-parameters lookup path, creating a new atom for any previously unseen value. An authorized policymaker can send roughly one million requests with distinct component values to exhaust the atom table and crash the node.

In RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, the trace consumer constructs the output path without a safe relative path check, even though the read side performs such a check. An administrator can use the name parameter to write a .log-suffixed file to an arbitrary filesystem path writable by the rabbitmq user, e.g. /etc/cron.d/x.log.

RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0: the AMQP 0-9-1 shovel removes credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and rabbitmqctl shovel_status.

RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0: when a binding is created on an x-jms-topic exchange, add_binding/3 reads the rjms_erlang_selector argument and passes it through erl_scan:string/1 and erl_parse:parse_term/1. erl_scan:string/1 interns every atom literal, validate_binding/2 is a no-op with no length cap. An authenticated low-privilege AMQP user can crash the entire broker node in fewer than 100 bind calls.

RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0: add_binding/3 parses the routing key as an integer weight N and computes ring positions with lists:seq(NextN0, NextN0 + N - 1). validate_binding/2 only checks N >= 1 with no upper bound. A user with write permission on a consistent-hash exchange can create a binding with a huge weight, allocating hundreds of megabytes on every cluster node.

In RabbitMQ prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, the HTTP handler accept_content/2 calls create_super_stream without the required configure permission check on the exchange and partition queues that is present in the stream-protocol path. A user with the management tag and vhost access but no configure permission can create super-streams via the HTTP API.

RabbitMQ prior to versions 4.1.11, 4.2.6, and 4.3.0: validate_partitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq(0, 500000000) allocates roughly 8GB.

In the RabbitMQ management UI (versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6), TLS client certificate details such as Subject and Issuer DN are rendered without HTML escaping. The vulnerability is reachable when a TLS listener is configured with verify_peer and an attacker holds a CA-signed client certificate with an arbitrary Subject CN. When an administrator views that connection in the UI, the injected script executes in the admin's browser session, leading to account takeover.

In RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, the /federation-links/.../restart route uses is_authorized_monitor which accepts the monitoring tag, and DELETE triggers a federation link restart without an elevated permission check. A monitoring-tagged user can restart any federation link.

In RabbitMQ, match_value/3 passes the user-supplied ?name= regular expression to re:run with no match_limit option and executes it once per resource in the result set. With a large result set, a single request can consume many minutes of CPU, and parallel requests saturate the schedulers. The path is reachable through normal API use with the use_regex=true option.

In RabbitMQ, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node.

In RabbitMQ prior to versions 4.1.13, 4.2.7, and 4.3.0, is_authorized/2 uses is_authorized_monitor for all methods, and DELETE resets authentication attempt counters. A monitoring-tagged user can reset these counters via DELETE /api/auth/attempts/:node, erasing evidence of brute-force activity.

In RabbitMQ, the ?LOG_DEBUG macro formats the entire Shovel state map, including the 'uris' field holding decrypted URIs with credentials. With DEBUG logging enabled, autodelete-shovel completion writes the full state map, including amqp://user:password@host/, to the broker log file.

In RabbitMQ, the stream open handler calls only check_vhost_access, omitting the node/vhost/user connection-limit checks that rabbit_reader performs for AMQP. An authenticated tenant can fully bypass operator-configured per-user and per-vhost connection caps by connecting via port 5552 instead of 5672.

A vulnerability was found in the sfturing hosp_order project in an unknown function of ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java. Manipulation leads to cross-site request forgery, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

An argument-injection flaw exists in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without integer validation, and the dispatcher flattens the management-command argument list into a single space-separated string, so spaces become additional arguments. An authenticated superuser can inject arbitrary arguments, including Python's path option, into the awx-manage process.