cnvd - cnvd-2015-00659

CNVD-2015-00659

Vulnerability from cnvd - Published: 2015-01-27

Title

Pivotal Software RabbitMQ management插件跨站脚本漏洞

Description

Pivotal Software RabbitMQ是英国Pivotal Software公司的一套实现了高级消息队列协议（AMQP）的开源消息代理软件。RabbitMQ management是其中的一个管理插件。 Pivotal Software RabbitMQ management插件存在跨站脚本漏洞。远程攻击者可通过消息详情、策略名称和AMQP网络客户端详情利用该漏洞以用户权限注入任意Web脚本或HTML或通过用户名和群组名利用该漏洞以管理员权限注入任意Web脚本或HTML或修改未指定内容。

Severity

低

Patch Name

Pivotal Software RabbitMQ management插件跨站脚本漏洞的补丁

Patch Description

Formal description

用户可参考如下供应商提供的安全公告获得补丁信息： http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100

Reference

http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0862

Impacted products

Name
Pivotal Software RabbitMQ management plugin <3.4.3

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-0862"
    }
  },
  "description": "Pivotal Software RabbitMQ\u662f\u82f1\u56fdPivotal Software\u516c\u53f8\u7684\u4e00\u5957\u5b9e\u73b0\u4e86\u9ad8\u7ea7\u6d88\u606f\u961f\u5217\u534f\u8bae\uff08AMQP\uff09\u7684\u5f00\u6e90\u6d88\u606f\u4ee3\u7406\u8f6f\u4ef6\u3002RabbitMQ management\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u7ba1\u7406\u63d2\u4ef6\u3002\r\n\r\nPivotal Software RabbitMQ management\u63d2\u4ef6\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u6d88\u606f\u8be6\u60c5\u3001\u7b56\u7565\u540d\u79f0\u548cAMQP\u7f51\u7edc\u5ba2\u6237\u7aef\u8be6\u60c5\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5\u7528\u6237\u6743\u9650\u6ce8\u5165\u4efb\u610fWeb\u811a\u672c\u6216HTML\u6216\u901a\u8fc7\u7528\u6237\u540d\u548c\u7fa4\u7ec4\u540d\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5\u7ba1\u7406\u5458\u6743\u9650\u6ce8\u5165\u4efb\u610fWeb\u811a\u672c\u6216HTML\u6216\u4fee\u6539\u672a\u6307\u5b9a\u5185\u5bb9\u3002",
  "discovererName": "Pivotal",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttp://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-00659",
  "openTime": "2015-01-27",
  "patchDescription": "Pivotal Software RabbitMQ\u662f\u82f1\u56fdPivotal Software\u516c\u53f8\u7684\u4e00\u5957\u5b9e\u73b0\u4e86\u9ad8\u7ea7\u6d88\u606f\u961f\u5217\u534f\u8bae\uff08AMQP\uff09\u7684\u5f00\u6e90\u6d88\u606f\u4ee3\u7406\u8f6f\u4ef6\u3002RabbitMQ management\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u7ba1\u7406\u63d2\u4ef6\u3002\r\nPivotal Software RabbitMQ management\u63d2\u4ef6\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u6d88\u606f\u8be6\u60c5\u3001\u7b56\u7565\u540d\u79f0\u548cAMQP\u7f51\u7edc\u5ba2\u6237\u7aef\u8be6\u60c5\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5\u7528\u6237\u6743\u9650\u6ce8\u5165\u4efb\u610fWeb\u811a\u672c\u6216HTML\u6216\u901a\u8fc7\u7528\u6237\u540d\u548c\u7fa4\u7ec4\u540d\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5\u7ba1\u7406\u5458\u6743\u9650\u6ce8\u5165\u4efb\u610fWeb\u811a\u672c\u6216HTML\u6216\u4fee\u6539\u672a\u6307\u5b9a\u5185\u5bb9\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Pivotal Software RabbitMQ management\u63d2\u4ef6\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Pivotal Software RabbitMQ management plugin \u003c3.4.3"
  },
  "referenceLink": "http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100\r\nhttp://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0862",
  "serverity": "\u4f4e",
  "submitTime": "2015-01-23",
  "title": "Pivotal Software RabbitMQ management\u63d2\u4ef6\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

CVE-2015-0862 (GCVE-0-2015-0862)

Vulnerability from cvelistv5 – Published: 2015-01-18 18:00 – Updated: 2024-08-06 04:26

Summary

Multiple cross-site scripting (XSS) vulnerabilities in the management web UI in the RabbitMQ management plugin before 3.4.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) message details when a message is unqueued, such as headers or arguments; (2) policy names, which are not properly handled when viewing policies; (3) details for AMQP network clients, such as the version; allow remote authenticated administrators to inject arbitrary web script or HTML via (4) user names, (5) the cluster name; or allow RabbitMQ cluster administrators to (6) modify unspecified content.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

http://www.rabbitmq.com/news.html#2015-01-08T10:1…

x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T04:26:10.895Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-01-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in the management web UI in the RabbitMQ management plugin before 3.4.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) message details when a message is unqueued, such as headers or arguments; (2) policy names, which are not properly handled when viewing policies; (3) details for AMQP network clients, such as the version; allow remote authenticated administrators to inject arbitrary web script or HTML via (4) user names, (5) the cluster name; or allow RabbitMQ cluster administrators to (6) modify unspecified content."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-01-18T17:57:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-0862",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in the management web UI in the RabbitMQ management plugin before 3.4.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) message details when a message is unqueued, such as headers or arguments; (2) policy names, which are not properly handled when viewing policies; (3) details for AMQP network clients, such as the version; allow remote authenticated administrators to inject arbitrary web script or HTML via (4) user names, (5) the cluster name; or allow RabbitMQ cluster administrators to (6) modify unspecified content."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100",
              "refsource": "CONFIRM",
              "url": "http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-0862",
    "datePublished": "2015-01-18T18:00:00",
    "dateReserved": "2015-01-07T00:00:00",
    "dateUpdated": "2024-08-06T04:26:10.895Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2015-00659

CVE-2015-0862 (GCVE-0-2015-0862)

Tags

Sightings

Nomenclature