CVE-2025-30219: RabbitMQ has XSS Vulnerability in an Error Message in Management UI
Last updated 31 March 2025
Other sources
RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user's browser). Open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3 and 3.13.8 patch the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rabbitmq-serverto a version that resolves this vulnerability.Fixed in 4.0.5-3 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.0.3 - Upgrade
Upgrade
Tanzu RabbitMQto a version that resolves this vulnerability.Fixed in 4.0.3 - Upgrade
Upgrade
Tanzu RabbitMQto a version that resolves this vulnerability.Fixed in 3.13.8
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30219?
CVE-2025-30219 has a high severity level due to its potential for arbitrary JavaScript code execution.
How do I fix CVE-2025-30219?
To resolve CVE-2025-30219, upgrade your RabbitMQ or Tanzu RabbitMQ installation to version 4.0.3 or higher.
What types of software are affected by CVE-2025-30219?
CVE-2025-30219 affects RabbitMQ versions prior to 4.0.3 and Tanzu RabbitMQ versions prior to 3.13.8 and 4.0.3.
What attacks are possible due to CVE-2025-30219?
CVE-2025-30219 allows attackers to modify virtual host names on disk and potentially execute arbitrary JavaScript code.
Is CVE-2025-30219 a local or remote vulnerability?
CVE-2025-30219 is considered a remote vulnerability as it can be exploited over the network.