BIT-rabbitmq-2021-22117

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/rabbitmq/BIT-rabbitmq-2021-22117.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-rabbitmq-2021-22117

Aliases

CVE-2021-22117

Published

2024-03-06T11:03:44.606Z

Modified

2024-03-06T11:25:28.861Z

Summary

[none]

Details

RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing attackers with sufficient local filesystem permissions to add arbitrary plugins.

Database specific

{
    "cpes": [
        "cpe:2.3:a:vmware:rabbitmq:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}

References

https://tanzu.vmware.com/security/cve-2021-22117

Affected packages

Bitnami / rabbitmq

Package

Name: rabbitmq
Purl: pkg:bitnami/rabbitmq

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

3.8.0

Fixed

3.8.16