Kritik CVSS 10 PoC var
CVE-2026-57216: Rabbitmq Server: hatalı kimlik doğrulama
Açıklama (NVD)
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the backend listener is loopback-bound because the loopback check uses the listener-side socket address instead of the real client source. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Özet bilgiler
- Ürün
- Broadcom Rabbitmq Server
- CVSS v3.1
- 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - EPSS
- %0,50 (yüzdelik 43)
- CWE
- CWE-287
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| broadcom-rabbitmq-server | 3.13.0 | — | 3.13.15 |
| broadcom-rabbitmq-server | 4.0.0 | — | 4.0.20 |
| broadcom-rabbitmq-server | 4.1.0 | — | 4.1.11 |
| broadcom-rabbitmq-server | 4.2.0 | — | 4.2.6 |