7.5
CVE-2019-11287
- EPSS 0.79%
- Published 23.11.2019 00:15:10
- Last modified 02.04.2025 14:13:43
- Source security@pivotal.io
- Teams watchlist Login
- Open Login
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.
Data is provided by the National Vulnerability Database (NVD)
Broadcom ≫ Rabbitmq Server Version >= 3.8.0 < 3.8.1
Pivotal Software ≫ Rabbitmq SwPlatformpivotal_cloud_foundry Version >= 1.16.0 < 1.16.7
Pivotal Software ≫ Rabbitmq SwPlatformpivotal_cloud_foundry Version >= 1.17.0 < 1.17.4
Pivotal Software ≫ Rabbitmq Version >= 3.7.0 < 3.7.21
Fedoraproject ≫ Fedora Version30
Fedoraproject ≫ Fedora Version31
Debian ≫ Debian Linux Version9.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.79% | 0.731 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:N/A:P
|
| security@pivotal.io | 4.5 | 0.9 | 3.6 |
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
|
CWE-134 Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
CWE-400 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.