CVE-2019-11281 — CVE & Security Advisory Radar

🎯 CVE-2019-11281 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2019-11281 | Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack that would gain access to virtual hosts and policy man

Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack that would gain access to virtual hosts and policy management information.

Klassifikation & Betroffenheit:

Pivotal RabbitMq for PCF 11.16.x prior to 1.16.6RabbitMq for PCF 1.15.x prior to 1.15.13RabbitMQ prior to v3.7.18RabbitMq for PCF 1.17.x prior to 1.17.3pivotal_software rabbitmq *redhat openstack 15redhat openstack_for_ibm_power 15debian debian_linux 9.0

Improper Control of Generation of Code ('Code Injection') 🎯 Medium

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

🛡️ Empfohlene Mitigation: Refactor your program so that you do not have to dynamically generate code.

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-35 · Leverage Executable Code in Non-Executab… (Very High) CAPEC-77 · Manipulating User-Controlled Variables (Very High) CAPEC-242 · Code Injection (High)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1027.006 · Obfuscated Files or Information: H… T1027.009 · Obfuscated Files or Information: E… T1564.009 · Hide Artifacts: Resource Forking

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2019-11275 3.5 CVE-2019-11291 3.1 CVE-2019-11273 2.2

🩹 Patch verfügbar (OSV):

🩹 ff44adbaf01276f2abea7d59da22ea518b6a1abe (Commit)

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2019

Veröffentlicht 10/2019

Heute 18.09.

CVSS-Vektor-Analyse: 2.4

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Hoch

UI · Interaktion Erforderlich

S · Scope Unverändert

C · Vertraulichkeit Gering

I · Integrität Keine

A · Verfügbarkeit Keine

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

Veröffentlicht:16.10.2019

Aktualisiert:17.06.2026 02:12

Assigner (CNA):pivotal

EUVD-ID:EUVD-2019-2969

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	2026-08-29	2026-09-17
≥90 %	4	0
≥50 %	4	0
≥10 %	3	0
<10 %	304	300

2.4 LOW

🇪🇺 EUVD

EPSS

1.2%

CVE-2019-11281 🌐 Netzwerk (Remote) 🔐 Admin-Rechte nötig

Pivotal

CVE-2019-11281 | Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack that would gain access to virtual hosts and policy man

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

16.10.2019

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub