VMware Rabbitmq vulnerabilities

6 CVEs affecting VMware Rabbitmq, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-46118, published 2023-10-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-32718, published 2021-06-28. Medium severity, CVSS 5.4. EPSS: 1.4% chance of exploitation in the next 30 days. RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation…
CVE-2021-32719, published 2021-06-28. Medium severity, CVSS 4.8. EPSS: 1.4% chance of exploitation in the next 30 days. RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the `rabbitmq_federation_management`…
CVE-2021-22116, published 2021-06-08. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the…
CVE-2023-46118, published 2023-10-25. Medium severity, CVSS 4.9. EPSS: 1.1% chance of exploitation in the next 30 days. RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An…
CVE-2019-11291, published 2019-11-22. Medium severity, CVSS 4.8. EPSS: 0.8% chance of exploitation in the next 30 days. Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints,…
CVE-2022-31008, published 2022-10-06. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to…