CVE-2021-32718

Name: CVE-2021-32718
Creator: NVD / NIST
Published: 2021-06-28T15:15:24.233+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 5.4/10EPSS 1.44%

Last modified Jun 17, 2026

CVE-2021-32718 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `<script>` tag sanitization, potentially allowing for JavaScript code execution in the context of the page. EPSS estimates a 1.44% chance of exploitation in the next 30 days.

Description

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `<script>` tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The vulnerability is patched in RabbitMQ 3.8.17. As a workaround, disable `rabbitmq_management` plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring.

Metrics

CVSS 3.1

5.4/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS Probability

1.44%

69.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Vmware	Rabbitmq	< 3.8.17

References

http://seclists.org/fulldisclosure/2021/Dec/3Exploit, Mailing List, Third Party Advisory
https://github.com/rabbitmq/rabbitmq-server/pull/3028Patch, Third Party Advisory
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c3hj-rg5h-2772Mitigation, Third Party Advisory
http://seclists.org/fulldisclosure/2021/Dec/3Exploit, Mailing List, Third Party Advisory
https://github.com/rabbitmq/rabbitmq-server/pull/3028Patch, Third Party Advisory
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c3hj-rg5h-2772Mitigation, Third Party Advisory

Timeline

Published: Jun 28, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-32718?

How severe is CVE-2021-32718?

CVE-2021-32718 has a CVSS score of 5.4/10 (MEDIUM severity). The EPSS model estimates a 1.44% probability of exploitation in the next 30 days.

How do I fix CVE-2021-32718?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-32718?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST