github - ghsa-pj33-75x5-32j4

ghsa-pj33-75x5-32j4

Vulnerability from github

Published

2024-11-06 19:55

Modified

2024-11-06 23:38

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
7.1 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

RabbitMQ HTTP API's queue deletion endpoint does not verify that the user has a required permission

Details

Summary

Queue deletion via the HTTP API was not verifying the configure permission of the user.

Impact

Users who had all of the following:

Valid credentials
Some permissions for the target virtual host
HTTP API access

could delete queues it had no (deletion) permissions for.

Workarounds

Disable management plugin and use, for example, Prometheus and Grafana for monitoring.

OWASP Classification

OWASP Top10 A01:2021 – Broken Access Control

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "rabbit_common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.12.7"
            },
            {
              "fixed": "3.12.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-51988"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-06T19:55:13Z",
    "nvd_published_at": "2024-11-06T20:15:06Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nQueue deletion via the HTTP API was not verifying the `configure` permission of the user.\n\n### Impact\n\nUsers who had all of the following:\n\n1. Valid credentials\n2. Some permissions for the target virtual host\n3. HTTP API access \n\ncould delete queues it had no (deletion) permissions for.\n\n### Workarounds\n\nDisable management plugin and use, for example, [Prometheus and Grafana](https://www.rabbitmq.com/docs/prometheus) for monitoring.\n\n### OWASP Classification\n\nOWASP Top10 A01:2021 \u2013 Broken Access Control\n",
  "id": "GHSA-pj33-75x5-32j4",
  "modified": "2024-11-06T23:38:44Z",
  "published": "2024-11-06T19:55:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj33-75x5-32j4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51988"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rabbitmq/rabbitmq-server"
    },
    {
      "type": "WEB",
      "url": "https://www.rabbitmq.com/docs/prometheus"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "RabbitMQ HTTP API\u0027s queue deletion endpoint does not verify that the user has a required permission"
}

cve-2024-51988

Vulnerability from cvelistv5

Published

2024-11-06 19:15

Modified

2024-11-06 19:53

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Summary

RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configure` permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host & 3. HTTP API access. could delete queues it had no (deletion) permissions for. This issue has been addressed in version 3.12.11 of the open source rabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the tanzu release. Users are advised to upgrade. Users unable to upgrade may disable management plugin and use, for example, Prometheus and Grafana for monitoring.

References

▼	URL	Tags
	https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj33-75x5-32j4	x_refsource_CONFIRM
	https://www.rabbitmq.com/docs/prometheus	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

rabbitmq

rabbitmq-server

Version: Open source RabbitMQ: >= 3.12.7, < 3.12.11
Version: Tanzu RabbitMQ: >= 2.0.0, < 3.13.0
Version: Tanzu RabbitMQ: < 1.5.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-51988",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T19:53:13.523222Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T19:53:22.685Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rabbitmq-server",
          "vendor": "rabbitmq",
          "versions": [
            {
              "status": "affected",
              "version": "Open source RabbitMQ: \u003e= 3.12.7, \u003c 3.12.11"
            },
            {
              "status": "affected",
              "version": "Tanzu RabbitMQ: \u003e= 2.0.0, \u003c 3.13.0"
            },
            {
              "status": "affected",
              "version": "Tanzu RabbitMQ: \u003c 1.5.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configure` permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host \u0026 3. HTTP API access. could delete queues it had no (deletion) permissions for. This issue has been addressed in version 3.12.11 of the open source rabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the tanzu release. Users are advised to upgrade. Users unable to upgrade may disable management plugin and use, for example, Prometheus and Grafana for monitoring."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-06T19:15:17.391Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj33-75x5-32j4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj33-75x5-32j4"
        },
        {
          "name": "https://www.rabbitmq.com/docs/prometheus",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.rabbitmq.com/docs/prometheus"
        }
      ],
      "source": {
        "advisory": "GHSA-pj33-75x5-32j4",
        "discovery": "UNKNOWN"
      },
      "title": "HTTP API\u0027s queue deletion endpoint does not verify that the user has a required permission"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-51988",
    "datePublished": "2024-11-06T19:15:17.391Z",
    "dateReserved": "2024-11-04T17:46:16.775Z",
    "dateUpdated": "2024-11-06T19:53:22.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-pj33-75x5-32j4

Vulnerability from github

Summary

Impact

Workarounds

OWASP Classification

cve-2024-51988

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature