Lucene search

DellCVE-2017-4966

HistoryJun 13, 2017 - 6:29 a.m.

CVE-2017-4966

2017-06-1306:29:00

CWE-200

dell

web.nvd.nist.gov

cve-2017-4966

pivotal rabbitmq

rabbitmq for pcf

user credentials

local storage

chained attack

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

High

EPSS

Percentile

12.6%

JSON

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user credentials in a browser’s local storage without expiration, making it possible to retrieve them using a chained attack.

Affected configurations

Nvd

Node

pivotal_softwarerabbitmqMatch3.5.4

pivotal_softwarerabbitmqMatch3.5.5

pivotal_softwarerabbitmqMatch3.5.7

pivotal_softwarerabbitmqMatch3.6.0

pivotal_softwarerabbitmqMatch3.6.1

pivotal_softwarerabbitmqMatch3.6.2

pivotal_softwarerabbitmqMatch3.6.3

pivotal_softwarerabbitmqMatch3.6.4

pivotal_softwarerabbitmqMatch3.6.5

pivotal_softwarerabbitmqMatch3.6.6

vmwarerabbitmqMatch3.4.0

vmwarerabbitmqMatch3.4.1

vmwarerabbitmqMatch3.4.2

vmwarerabbitmqMatch3.4.3

vmwarerabbitmqMatch3.4.4

vmwarerabbitmqMatch3.5.0

vmwarerabbitmqMatch3.5.1

vmwarerabbitmqMatch3.5.2

vmwarerabbitmqMatch3.5.3

vmwarerabbitmqMatch3.5.6

vmwarerabbitmqMatch3.6.7

Node

pivotal_softwarerabbitmqMatch1.5.0pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.5.1pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.5.2pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.5.3pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.5.4pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.5.5pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.5.6pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.5.7pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.5.8pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.5.9pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.5.10pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.5.11pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.5.12pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.5.13pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.5.14pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.5.15pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.5.17pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.5.18pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.5.19pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.6.0pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.6.1pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.6.2pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.6.3pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.6.4pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.6.5pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.6.6pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.6.7pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.6.8pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.6.9pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.6.10pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.6.12pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.6.13pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.6.14pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.6.15pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.6.16pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.7.0pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.7.2pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.7.3pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.7.4pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.7.5pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.7.6pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.7.7pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.7.8pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.7.9pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.7.10pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.7.13pivotal_cloud_foundry

pivotal_softwarerabbitmqMatch1.7.14pivotal_cloud_foundry

Node

debiandebian_linuxMatch9.0

VendorProductVersionCPE
pivotal_softwarerabbitmq3.5.4cpe:2.3:a:pivotal_software:rabbitmq:3.5.4:*:*:*:*:*:*:*
pivotal_softwarerabbitmq3.5.5cpe:2.3:a:pivotal_software:rabbitmq:3.5.5:*:*:*:*:*:*:*
pivotal_softwarerabbitmq3.5.7cpe:2.3:a:pivotal_software:rabbitmq:3.5.7:*:*:*:*:*:*:*
pivotal_softwarerabbitmq3.6.0cpe:2.3:a:pivotal_software:rabbitmq:3.6.0:*:*:*:*:*:*:*
pivotal_softwarerabbitmq3.6.1cpe:2.3:a:pivotal_software:rabbitmq:3.6.1:*:*:*:*:*:*:*
pivotal_softwarerabbitmq3.6.2cpe:2.3:a:pivotal_software:rabbitmq:3.6.2:*:*:*:*:*:*:*
pivotal_softwarerabbitmq3.6.3cpe:2.3:a:pivotal_software:rabbitmq:3.6.3:*:*:*:*:*:*:*
pivotal_softwarerabbitmq3.6.4cpe:2.3:a:pivotal_software:rabbitmq:3.6.4:*:*:*:*:*:*:*
pivotal_softwarerabbitmq3.6.5cpe:2.3:a:pivotal_software:rabbitmq:3.6.5:*:*:*:*:*:*:*
pivotal_softwarerabbitmq3.6.6cpe:2.3:a:pivotal_software:rabbitmq:3.6.6:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pivotal_software	rabbitmq	3.5.4	cpe:2.3:a:pivotal_software:rabbitmq:3.5.4:::::::*
pivotal_software	rabbitmq	3.5.5	cpe:2.3:a:pivotal_software:rabbitmq:3.5.5:::::::*
pivotal_software	rabbitmq	3.5.7	cpe:2.3:a:pivotal_software:rabbitmq:3.5.7:::::::*
pivotal_software	rabbitmq	3.6.0	cpe:2.3:a:pivotal_software:rabbitmq:3.6.0:::::::*
pivotal_software	rabbitmq	3.6.1	cpe:2.3:a:pivotal_software:rabbitmq:3.6.1:::::::*
pivotal_software	rabbitmq	3.6.2	cpe:2.3:a:pivotal_software:rabbitmq:3.6.2:::::::*
pivotal_software	rabbitmq	3.6.3	cpe:2.3:a:pivotal_software:rabbitmq:3.6.3:::::::*
pivotal_software	rabbitmq	3.6.4	cpe:2.3:a:pivotal_software:rabbitmq:3.6.4:::::::*
pivotal_software	rabbitmq	3.6.5	cpe:2.3:a:pivotal_software:rabbitmq:3.6.5:::::::*
pivotal_software	rabbitmq	3.6.6	cpe:2.3:a:pivotal_software:rabbitmq:3.6.6:::::::*

Rows per page:

1-10 of 691

CNA Affected

[
  {
    "product": "Pivotal RabbitMQ",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Pivotal RabbitMQ"
      }
    ]
  }
]