Vulnerability-Lookup

CVE-2024-51988 (GCVE-0-2024-51988)

Vulnerability from cvelistv5 – Published: 2024-11-06 19:15 – Updated: 2024-11-06 19:53

Title

HTTP API's queue deletion endpoint does not verify that the user has a required permission

Summary

RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configure` permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host & 3. HTTP API access. could delete queues it had no (deletion) permissions for. This issue has been addressed in version 3.12.11 of the open source rabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the tanzu release. Users are advised to upgrade. Users unable to upgrade may disable management plugin and use, for example, Prometheus and Grafana for monitoring.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-284 - Improper Access Control

Assigner

GitHub_M

References

URL

Tags

	https://github.com/rabbitmq/rabbitmq-server/secur…	x_refsource_CONFIRM
	https://www.rabbitmq.com/docs/prometheus	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	rabbitmq	rabbitmq-server	Affected: Open source RabbitMQ: >= 3.12.7, < 3.12.11 Affected: Tanzu RabbitMQ: >= 2.0.0, < 3.13.0 Affected: Tanzu RabbitMQ: < 1.5.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-51988",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T19:53:13.523222Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T19:53:22.685Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rabbitmq-server",
          "vendor": "rabbitmq",
          "versions": [
            {
              "status": "affected",
              "version": "Open source RabbitMQ: \u003e= 3.12.7, \u003c 3.12.11"
            },
            {
              "status": "affected",
              "version": "Tanzu RabbitMQ: \u003e= 2.0.0, \u003c 3.13.0"
            },
            {
              "status": "affected",
              "version": "Tanzu RabbitMQ: \u003c 1.5.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configure` permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host \u0026 3. HTTP API access. could delete queues it had no (deletion) permissions for. This issue has been addressed in version 3.12.11 of the open source rabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the tanzu release. Users are advised to upgrade. Users unable to upgrade may disable management plugin and use, for example, Prometheus and Grafana for monitoring."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-06T19:15:17.391Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj33-75x5-32j4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj33-75x5-32j4"
        },
        {
          "name": "https://www.rabbitmq.com/docs/prometheus",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.rabbitmq.com/docs/prometheus"
        }
      ],
      "source": {
        "advisory": "GHSA-pj33-75x5-32j4",
        "discovery": "UNKNOWN"
      },
      "title": "HTTP API\u0027s queue deletion endpoint does not verify that the user has a required permission"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-51988",
    "datePublished": "2024-11-06T19:15:17.391Z",
    "dateReserved": "2024-11-04T17:46:16.775Z",
    "dateUpdated": "2024-11-06T19:53:22.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-51988\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-06T19:53:13.523222Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-06T19:53:19.420Z\"}}], \"cna\": {\"title\": \"HTTP API\u0027s queue deletion endpoint does not verify that the user has a required permission\", \"source\": {\"advisory\": \"GHSA-pj33-75x5-32j4\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"rabbitmq\", \"product\": \"rabbitmq-server\", \"versions\": [{\"status\": \"affected\", \"version\": \"Open source RabbitMQ: \u003e= 3.12.7, \u003c 3.12.11\"}, {\"status\": \"affected\", \"version\": \"Tanzu RabbitMQ: \u003e= 2.0.0, \u003c 3.13.0\"}, {\"status\": \"affected\", \"version\": \"Tanzu RabbitMQ: \u003c 1.5.2\"}]}], \"references\": [{\"url\": \"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj33-75x5-32j4\", \"name\": \"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj33-75x5-32j4\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://www.rabbitmq.com/docs/prometheus\", \"name\": \"https://www.rabbitmq.com/docs/prometheus\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configure` permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host \u0026 3. HTTP API access. could delete queues it had no (deletion) permissions for. This issue has been addressed in version 3.12.11 of the open source rabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the tanzu release. Users are advised to upgrade. Users unable to upgrade may disable management plugin and use, for example, Prometheus and Grafana for monitoring.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-284\", \"description\": \"CWE-284: Improper Access Control\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-11-06T19:15:17.391Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-51988\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-06T19:53:22.685Z\", \"dateReserved\": \"2024-11-04T17:46:16.775Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-11-06T19:15:17.391Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-PJ33-75X5-32J4

Vulnerability from github – Published: 2024-11-06 19:55 – Updated: 2024-11-06 23:38

Summary

RabbitMQ HTTP API's queue deletion endpoint does not verify that the user has a required permission

Details

Summary

Queue deletion via the HTTP API was not verifying the configure permission of the user.

Impact

Users who had all of the following:

Valid credentials
Some permissions for the target virtual host
HTTP API access

could delete queues it had no (deletion) permissions for.

Workarounds

Disable management plugin and use, for example, Prometheus and Grafana for monitoring.

OWASP Classification

OWASP Top10 A01:2021 – Broken Access Control

Severity ?

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

7.1 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "rabbit_common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.12.7"
            },
            {
              "fixed": "3.12.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-51988"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-06T19:55:13Z",
    "nvd_published_at": "2024-11-06T20:15:06Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nQueue deletion via the HTTP API was not verifying the `configure` permission of the user.\n\n### Impact\n\nUsers who had all of the following:\n\n1. Valid credentials\n2. Some permissions for the target virtual host\n3. HTTP API access \n\ncould delete queues it had no (deletion) permissions for.\n\n### Workarounds\n\nDisable management plugin and use, for example, [Prometheus and Grafana](https://www.rabbitmq.com/docs/prometheus) for monitoring.\n\n### OWASP Classification\n\nOWASP Top10 A01:2021 \u2013 Broken Access Control\n",
  "id": "GHSA-pj33-75x5-32j4",
  "modified": "2024-11-06T23:38:44Z",
  "published": "2024-11-06T19:55:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj33-75x5-32j4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51988"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rabbitmq/rabbitmq-server"
    },
    {
      "type": "WEB",
      "url": "https://www.rabbitmq.com/docs/prometheus"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "RabbitMQ HTTP API\u0027s queue deletion endpoint does not verify that the user has a required permission"
}

bit-rabbitmq-2024-51988

Vulnerability from bitnami_vulndb

Published

2024-11-08 07:17

Modified

2025-05-20 10:02

Summary

HTTP API's queue deletion endpoint does not verify that the user has a required permission

Details

RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the configure permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host & 3. HTTP API access. could delete queues it had no (deletion) permissions for. This issue has been addressed in version 3.12.11 of the open source rabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the tanzu release. Users are advised to upgrade. Users unable to upgrade may disable management plugin and use, for example, Prometheus and Grafana for monitoring.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "rabbitmq",
        "purl": "pkg:bitnami/rabbitmq"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.12.7"
            },
            {
              "fixed": "3.12.11"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-51988"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:vmware:rabbitmq:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
  },
  "details": "RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configure` permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host \u0026 3. HTTP API access. could delete queues it had no (deletion) permissions for. This issue has been addressed in version 3.12.11 of the open source rabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the tanzu release. Users are advised to upgrade. Users unable to upgrade may disable management plugin and use, for example, Prometheus and Grafana for monitoring.",
  "id": "BIT-rabbitmq-2024-51988",
  "modified": "2025-05-20T10:02:07.006Z",
  "published": "2024-11-08T07:17:02.800Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj33-75x5-32j4"
    },
    {
      "type": "WEB",
      "url": "https://www.rabbitmq.com/docs/prometheus"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51988"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "HTTP API\u0027s queue deletion endpoint does not verify that the user has a required permission"
}

FKIE_CVE-2024-51988

Vulnerability from fkie_nvd - Published: 2024-11-06 20:15 - Updated: 2024-11-08 19:01

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj33-75x5-32j4
	security-advisories@github.com	https://www.rabbitmq.com/docs/prometheus

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configure` permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host \u0026 3. HTTP API access. could delete queues it had no (deletion) permissions for. This issue has been addressed in version 3.12.11 of the open source rabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the tanzu release. Users are advised to upgrade. Users unable to upgrade may disable management plugin and use, for example, Prometheus and Grafana for monitoring."
    },
    {
      "lang": "es",
      "value": "RabbitMQ es un agente de mensajer\u00eda y transmisi\u00f3n de m\u00faltiples protocolos con numerosas funciones. En las versiones afectadas, la eliminaci\u00f3n de colas a trav\u00e9s de la API HTTP no verificaba el permiso `configure` del usuario. Los usuarios que ten\u00edan todo lo siguiente: 1. Credenciales v\u00e1lidas, 2. Algunos permisos para el host virtual de destino y 3. Acceso a la API HTTP pod\u00edan eliminar colas para las que no ten\u00edan permisos (de eliminaci\u00f3n). Este problema se ha solucionado en la versi\u00f3n 3.12.11 de la versi\u00f3n de c\u00f3digo abierto rabbitMQ y en las versiones 1.5.2, 3.13.0 y 4.0.0 de la versi\u00f3n tanzu. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar pueden deshabilitar el complemento de administraci\u00f3n y usar, por ejemplo, Prometheus y Grafana para la supervisi\u00f3n."
    }
  ],
  "id": "CVE-2024-51988",
  "lastModified": "2024-11-08T19:01:25.633",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-11-06T20:15:06.513",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj33-75x5-32j4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://www.rabbitmq.com/docs/prometheus"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-51988 (GCVE-0-2024-51988)

GHSA-PJ33-75X5-32J4

Summary

Impact

Workarounds

OWASP Classification

bit-rabbitmq-2024-51988

Vulnerability from bitnami_vulndb

FKIE_CVE-2024-51988

Tags

Sightings

Nomenclature