Vulnerability Details CVE-2017-4966
An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user credentials in a browser's local storage without expiration, making it possible to retrieve them using a chained attack.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 26.4%
CVSS Severity
CVSS v3 Score 7.8
CVSS v2 Score 2.1
References
Products affected by CVE-2017-4966
-
cpe:2.3:a:broadcom:rabbitmq_server:3.4.0
-
cpe:2.3:a:broadcom:rabbitmq_server:3.4.1
-
cpe:2.3:a:broadcom:rabbitmq_server:3.4.2
-
cpe:2.3:a:broadcom:rabbitmq_server:3.4.3
-
cpe:2.3:a:broadcom:rabbitmq_server:3.4.4
-
cpe:2.3:a:broadcom:rabbitmq_server:3.5.0
-
cpe:2.3:a:broadcom:rabbitmq_server:3.5.1
-
cpe:2.3:a:broadcom:rabbitmq_server:3.5.2
-
cpe:2.3:a:broadcom:rabbitmq_server:3.5.3
-
cpe:2.3:a:broadcom:rabbitmq_server:3.5.6
-
cpe:2.3:a:broadcom:rabbitmq_server:3.6.7
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.0
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.1
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.10
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.11
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.12
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.13
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.14
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.15
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.17
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.18
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.19
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.2
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.3
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.4
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.5
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.6
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.7
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.8
-
cpe:2.3:a:pivotal_software:rabbitmq:1.5.9
-
cpe:2.3:a:pivotal_software:rabbitmq:1.6.0
-
cpe:2.3:a:pivotal_software:rabbitmq:1.6.1
-
cpe:2.3:a:pivotal_software:rabbitmq:1.6.10
-
cpe:2.3:a:pivotal_software:rabbitmq:1.6.12
-
cpe:2.3:a:pivotal_software:rabbitmq:1.6.13
-
cpe:2.3:a:pivotal_software:rabbitmq:1.6.14
-
cpe:2.3:a:pivotal_software:rabbitmq:1.6.15
-
cpe:2.3:a:pivotal_software:rabbitmq:1.6.16
-
cpe:2.3:a:pivotal_software:rabbitmq:1.6.2
-
cpe:2.3:a:pivotal_software:rabbitmq:1.6.3
-
cpe:2.3:a:pivotal_software:rabbitmq:1.6.4
-
cpe:2.3:a:pivotal_software:rabbitmq:1.6.5
-
cpe:2.3:a:pivotal_software:rabbitmq:1.6.6
-
cpe:2.3:a:pivotal_software:rabbitmq:1.6.7
-
cpe:2.3:a:pivotal_software:rabbitmq:1.6.8
-
cpe:2.3:a:pivotal_software:rabbitmq:1.6.9
-
cpe:2.3:a:pivotal_software:rabbitmq:1.7.0
-
cpe:2.3:a:pivotal_software:rabbitmq:1.7.10
-
cpe:2.3:a:pivotal_software:rabbitmq:1.7.13
-
cpe:2.3:a:pivotal_software:rabbitmq:1.7.14
-
cpe:2.3:a:pivotal_software:rabbitmq:1.7.2
-
cpe:2.3:a:pivotal_software:rabbitmq:1.7.3
-
cpe:2.3:a:pivotal_software:rabbitmq:1.7.4
-
cpe:2.3:a:pivotal_software:rabbitmq:1.7.5
-
cpe:2.3:a:pivotal_software:rabbitmq:1.7.6
-
cpe:2.3:a:pivotal_software:rabbitmq:1.7.7
-
cpe:2.3:a:pivotal_software:rabbitmq:1.7.8
-
cpe:2.3:a:pivotal_software:rabbitmq:1.7.9
-
cpe:2.3:a:pivotal_software:rabbitmq:3.5.4
-
cpe:2.3:a:pivotal_software:rabbitmq:3.5.5
-
cpe:2.3:a:pivotal_software:rabbitmq:3.5.7
-
cpe:2.3:a:pivotal_software:rabbitmq:3.6.0
-
cpe:2.3:a:pivotal_software:rabbitmq:3.6.1
-
cpe:2.3:a:pivotal_software:rabbitmq:3.6.2
-
cpe:2.3:a:pivotal_software:rabbitmq:3.6.3
-
cpe:2.3:a:pivotal_software:rabbitmq:3.6.4
-
cpe:2.3:a:pivotal_software:rabbitmq:3.6.5
-
cpe:2.3:a:pivotal_software:rabbitmq:3.6.6
-
cpe:2.3:o:debian:debian_linux:9.0