Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UI

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `<script>` tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The vulnerability is patched in RabbitMQ 3.8.17. As a workaround, disable `rabbitmq_management` plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring.

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本)

RabbitMQ跨站脚本漏洞

Pivotal Software RabbitMQ是美国Pivotal Software公司的一套实现了高级消息队列协议（AMQP）的开源消息代理软件。 RabbitMQ 3.8.17之前版本存在跨站脚本漏洞，该漏洞源于当通过管理 UI 添加新用户时，其名称会在未进行适当script标记清理的确认消息中呈现。

N/A

N/A