Jenkins Enterprise and Operations Center 2.346.x < 2.346.40.0.7 Multiple Vulnerabilities (CloudBees Security Advisory 2023-01-24)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.346.x prior to 2.346.40.0.7. It is, therefore, affected by multiple vulnerabilities including the following: - Sandbox bypass vulnerability in Script Security Plugin CVE-2023-24422 - CSRF...

CVE-2023-24448

CVE-2023-24448 affects the Jenkins RabbitMQ Consumer Plugin, versions 2.8 and earlier. The root cause is a missing permission check in a form-validation path, which allows attackers with Overall/Read permission to connect to an attacker-specified AMQP(S) URL using attacker-specified credentials. ...

PT-2023-19608 · Jenkins · Jenkins Rabbitmq Consumer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins RabbitMQ Consumer Plugin versions 2.8 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified AMQPS URL using an attacker-specified username a...

CVE-2023-24448

A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified AMQPS URL using attacker-specified username and password...

PT-2023-19607 · Jenkins · Jenkins Rabbitmq Consumer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins RabbitMQ Consumer Plugin versions 2.8 and earlier Description: A cross-site request forgery issue allows attackers to connect to an attacker-specified AMQPS URL using an attacker-specified username and password. Recommendations: For...

CVE-2023-24447

A cross-site request forgery CSRF vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attacker-specified AMQPS URL using attacker-specified username and password...

CVE-2023-24448

A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified AMQPS URL using attacker-specified username and password...

CVE-2023-24447

A cross-site request forgery CSRF vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attacker-specified AMQPS URL using attacker-specified username and password...

RHEL 8 : rabbitmq-server (RHSA-2020:0553)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:0553 advisory. RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable...

RHEL 8 : Red Hat OpenStack Platform 16.1.9 (rabbitmq-server) (RHSA-2022:8867)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:8867 advisory. RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable...

RHEL 8 : rabbitmq-server (RHSA-2020:0078)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0078 advisory. RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and...

RHEL 8 : Red Hat OpenStack Platform 16.2.4 (rabbitmq-server) (RHSA-2022:8851)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:8851 advisory. RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and...

The vulnerability of the AMQP protocol implementation of the message broker RabbitMQ in Dell EMC NetWorker’s backup and disaster recovery systems allows a perpetrator to escalate their privileges.

The vulnerability of the Advanced Message Queuing Protocol AMQP implementation of the message broker RabbitMQ in Dell EMC NetWorker’s backup and disaster recovery systems lies in the transmission of critical information in plaintext. Exploiting this vulnerability could allow an attacker to enhanc...

SUSE: Security Advisory (SUSE-SU-2022:4378-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15 / openSUSE 15 Security Update : rabbitmq-server (SUSE-SU-2022:4378-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:4378-1 advisory. - CVE-2022-31008: Fixed predictable secret seed in URI encryption bsc1205267. Tenable has extracted the preceding description...

SUSE-SU-2022:4378-1 Security update for rabbitmq-server

This update for rabbitmq-server fixes the following issues: - CVE-2022-31008: Fixed predictable secret seed in URI encryption bsc1205267...

rabbitmq-server: improper neutralization of script-related HTML tags in a web page (basic XSS) in management UI

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper tag sanitization, potentially allowing for JavaScript code execution in the...

Low: Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (rabbitmq-server) security update

An update for rabbitmq-server is now available for Red Hat OpenStack Platform 16.1.9 Train for Red Hat Enterprise Linux RHEL 8.2. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...

Low: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (rabbitmq-server) security update

An update for rabbitmq-server is now available for Red Hat OpenStack Platform 16.2.4 Train for Red Hat Enterprise Linux RHEL 8.4. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...

rabbitmq-server: improper neutralization of script-related HTML tags in a web page (basic XSS) in federation management plugin

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the rabbitmqfederationmanagement plugin, its consumer tag was rendered without proper tag sanitization. This potentially allows for...