CVE-2017-4966 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2017-4966 Interim 1 34 2025-05-01T01:22:41Z current 2021-05-30T13:51:24Z 2025-05-01T01:22:41Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2017-4966 An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user credentials in a browser's local storage without expiration, making it possible to retrieve them using a chained attack. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE CaaS Platform 4.5 SUSE Cloud 5 SUSE Enterprise Storage 2.1 SUSE Enterprise Storage 3 SUSE Enterprise Storage 4 SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise Module for Server Applications 15 SP5 SUSE Linux Enterprise Module for Server Applications 15 SP6 SUSE Linux Enterprise Real Time 15 SP2 SUSE Linux Enterprise Real Time 15 SP3 SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Module for Server Applications 15 SP5 SUSE Linux Enterprise Module for Server Applications 15 SP6 SUSE Linux Enterprise Server Business Critical Linux 15 SP2 SUSE Linux Enterprise Server Business Critical Linux 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP5 SUSE Linux Enterprise Module for Server Applications 15 SP6 SUSE Manager Proxy 4.1 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Manager Proxy 4.2 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.1 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Manager Retail Branch Server 4.2 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.1 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Manager Server 4.2 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Manager Server 4.3 SUSE OpenStack Cloud 6 SUSE OpenStack Cloud 7 openSUSE Leap 15.5 openSUSE Leap 15.6 erlang-rabbitmq-client rabbitmq-server rabbitmq-server-plugins rabbitmq-server as a component of SUSE CaaS Platform 4.5 rabbitmq-server as a component of SUSE Cloud 5 rabbitmq-server as a component of SUSE Enterprise Storage 2.1 rabbitmq-server as a component of SUSE Enterprise Storage 3 rabbitmq-server as a component of SUSE Enterprise Storage 4 rabbitmq-server as a component of SUSE Enterprise Storage 7 erlang-rabbitmq-client as a component of SUSE Enterprise Storage 7.1 rabbitmq-server as a component of SUSE Enterprise Storage 7.1 rabbitmq-server-plugins as a component of SUSE Enterprise Storage 7.1 erlang-rabbitmq-client as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS rabbitmq-server as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS rabbitmq-server-plugins as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS erlang-rabbitmq-client as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS rabbitmq-server as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS rabbitmq-server-plugins as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS erlang-rabbitmq-client as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS rabbitmq-server as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS rabbitmq-server-plugins as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS erlang-rabbitmq-client as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS rabbitmq-server as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS rabbitmq-server-plugins as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS erlang-rabbitmq-client as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS rabbitmq-server as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS rabbitmq-server-plugins as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS erlang-rabbitmq-client as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS rabbitmq-server as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS rabbitmq-server-plugins as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS erlang-rabbitmq-client as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 rabbitmq-server as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 rabbitmq-server-plugins as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 erlang-rabbitmq-client as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 rabbitmq-server as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 rabbitmq-server-plugins as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 erlang-rabbitmq-client as a component of SUSE Linux Enterprise Module for Server Applications 15 SP5 rabbitmq-server as a component of SUSE Linux Enterprise Module for Server Applications 15 SP5 rabbitmq-server-plugins as a component of SUSE Linux Enterprise Module for Server Applications 15 SP5 erlang-rabbitmq-client as a component of SUSE Linux Enterprise Module for Server Applications 15 SP6 rabbitmq-server as a component of SUSE Linux Enterprise Module for Server Applications 15 SP6 rabbitmq-server-plugins as a component of SUSE Linux Enterprise Module for Server Applications 15 SP6 erlang-rabbitmq-client as a component of SUSE Linux Enterprise Real Time 15 SP2 rabbitmq-server as a component of SUSE Linux Enterprise Real Time 15 SP2 rabbitmq-server-plugins as a component of SUSE Linux Enterprise Real Time 15 SP2 erlang-rabbitmq-client as a component of SUSE Linux Enterprise Real Time 15 SP3 rabbitmq-server as a component of SUSE Linux Enterprise Real Time 15 SP3 rabbitmq-server-plugins as a component of SUSE Linux Enterprise Real Time 15 SP3 erlang-rabbitmq-client as a component of SUSE Linux Enterprise Server 15 SP2-LTSS rabbitmq-server as a component of SUSE Linux Enterprise Server 15 SP2-LTSS rabbitmq-server-plugins as a component of SUSE Linux Enterprise Server 15 SP2-LTSS erlang-rabbitmq-client as a component of SUSE Linux Enterprise Server 15 SP3-LTSS rabbitmq-server as a component of SUSE Linux Enterprise Server 15 SP3-LTSS rabbitmq-server-plugins as a component of SUSE Linux Enterprise Server 15 SP3-LTSS erlang-rabbitmq-client as a component of SUSE Linux Enterprise Server 15 SP4-LTSS rabbitmq-server as a component of SUSE Linux Enterprise Server 15 SP4-LTSS rabbitmq-server-plugins as a component of SUSE Linux Enterprise Server 15 SP4-LTSS rabbitmq-server as a component of SUSE Linux Enterprise Server Business Critical Linux 15 SP2 rabbitmq-server as a component of SUSE Linux Enterprise Server Business Critical Linux 15 SP3 erlang-rabbitmq-client as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 rabbitmq-server as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 rabbitmq-server-plugins as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 erlang-rabbitmq-client as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 rabbitmq-server as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 rabbitmq-server-plugins as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 erlang-rabbitmq-client as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 rabbitmq-server as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 rabbitmq-server-plugins as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 rabbitmq-server as a component of SUSE Manager Proxy 4.1 erlang-rabbitmq-client as a component of SUSE Manager Proxy 4.2 rabbitmq-server as a component of SUSE Manager Proxy 4.2 rabbitmq-server-plugins as a component of SUSE Manager Proxy 4.2 erlang-rabbitmq-client as a component of SUSE Manager Proxy 4.3 rabbitmq-server as a component of SUSE Manager Proxy 4.3 rabbitmq-server-plugins as a component of SUSE Manager Proxy 4.3 rabbitmq-server as a component of SUSE Manager Retail Branch Server 4.1 erlang-rabbitmq-client as a component of SUSE Manager Retail Branch Server 4.2 rabbitmq-server as a component of SUSE Manager Retail Branch Server 4.2 rabbitmq-server-plugins as a component of SUSE Manager Retail Branch Server 4.2 erlang-rabbitmq-client as a component of SUSE Manager Retail Branch Server 4.3 rabbitmq-server as a component of SUSE Manager Retail Branch Server 4.3 rabbitmq-server-plugins as a component of SUSE Manager Retail Branch Server 4.3 rabbitmq-server as a component of SUSE Manager Server 4.1 erlang-rabbitmq-client as a component of SUSE Manager Server 4.2 rabbitmq-server as a component of SUSE Manager Server 4.2 rabbitmq-server-plugins as a component of SUSE Manager Server 4.2 erlang-rabbitmq-client as a component of SUSE Manager Server 4.3 rabbitmq-server as a component of SUSE Manager Server 4.3 rabbitmq-server-plugins as a component of SUSE Manager Server 4.3 rabbitmq-server as a component of SUSE OpenStack Cloud 6 rabbitmq-server-plugins as a component of SUSE OpenStack Cloud 6 rabbitmq-server as a component of SUSE OpenStack Cloud 7 rabbitmq-server-plugins as a component of SUSE OpenStack Cloud 7 erlang-rabbitmq-client as a component of openSUSE Leap 15.5 rabbitmq-server as a component of openSUSE Leap 15.5 rabbitmq-server-plugins as a component of openSUSE Leap 15.5 erlang-rabbitmq-client as a component of openSUSE Leap 15.6 rabbitmq-server as a component of openSUSE Leap 15.6 rabbitmq-server-plugins as a component of openSUSE Leap 15.6 An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user credentials in a browser's local storage without expiration, making it possible to retrieve them using a chained attack. CVE-2017-4966 SUSE CaaS Platform 4.5:rabbitmq-server SUSE Cloud 5:rabbitmq-server SUSE Enterprise Storage 2.1:rabbitmq-server SUSE Enterprise Storage 3:rabbitmq-server SUSE Enterprise Storage 4:rabbitmq-server SUSE Enterprise Storage 7.1:erlang-rabbitmq-client SUSE Enterprise Storage 7.1:rabbitmq-server SUSE Enterprise Storage 7.1:rabbitmq-server-plugins SUSE Enterprise Storage 7:rabbitmq-server SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:erlang-rabbitmq-client SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:rabbitmq-server SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:rabbitmq-server-plugins SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:erlang-rabbitmq-client SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:rabbitmq-server SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:rabbitmq-server-plugins SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:erlang-rabbitmq-client SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:rabbitmq-server SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:rabbitmq-server-plugins SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:erlang-rabbitmq-client SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rabbitmq-server SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rabbitmq-server-plugins SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:erlang-rabbitmq-client SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rabbitmq-server SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rabbitmq-server-plugins SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:erlang-rabbitmq-client SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rabbitmq-server SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rabbitmq-server-plugins SUSE Linux Enterprise Module for Server Applications 15 SP3:erlang-rabbitmq-client SUSE Linux Enterprise Module for Server Applications 15 SP3:rabbitmq-server SUSE Linux Enterprise Module for Server Applications 15 SP3:rabbitmq-server-plugins SUSE Linux Enterprise Module for Server Applications 15 SP4:erlang-rabbitmq-client SUSE Linux Enterprise Module for Server Applications 15 SP4:rabbitmq-server SUSE Linux Enterprise Module for Server Applications 15 SP4:rabbitmq-server-plugins SUSE Linux Enterprise Module for Server Applications 15 SP5:erlang-rabbitmq-client SUSE Linux Enterprise Module for Server Applications 15 SP5:rabbitmq-server SUSE Linux Enterprise Module for Server Applications 15 SP5:rabbitmq-server-plugins SUSE Linux Enterprise Module for Server Applications 15 SP6:erlang-rabbitmq-client SUSE Linux Enterprise Module for Server Applications 15 SP6:rabbitmq-server SUSE Linux Enterprise Module for Server Applications 15 SP6:rabbitmq-server-plugins SUSE Linux Enterprise Real Time 15 SP2:erlang-rabbitmq-client SUSE Linux Enterprise Real Time 15 SP2:rabbitmq-server SUSE Linux Enterprise Real Time 15 SP2:rabbitmq-server-plugins SUSE Linux Enterprise Real Time 15 SP3:erlang-rabbitmq-client SUSE Linux Enterprise Real Time 15 SP3:rabbitmq-server SUSE Linux Enterprise Real Time 15 SP3:rabbitmq-server-plugins SUSE Linux Enterprise Server 15 SP2-LTSS:erlang-rabbitmq-client SUSE Linux Enterprise Server 15 SP2-LTSS:rabbitmq-server SUSE Linux Enterprise Server 15 SP2-LTSS:rabbitmq-server-plugins SUSE Linux Enterprise Server 15 SP3-LTSS:erlang-rabbitmq-client SUSE Linux Enterprise Server 15 SP3-LTSS:rabbitmq-server SUSE Linux Enterprise Server 15 SP3-LTSS:rabbitmq-server-plugins SUSE Linux Enterprise Server 15 SP4-LTSS:erlang-rabbitmq-client SUSE Linux Enterprise Server 15 SP4-LTSS:rabbitmq-server SUSE Linux Enterprise Server 15 SP4-LTSS:rabbitmq-server-plugins SUSE Linux Enterprise Server Business Critical Linux 15 SP2:rabbitmq-server SUSE Linux Enterprise Server Business Critical Linux 15 SP3:rabbitmq-server SUSE Linux Enterprise Server for SAP Applications 15 SP2:erlang-rabbitmq-client SUSE Linux Enterprise Server for SAP Applications 15 SP2:rabbitmq-server SUSE Linux Enterprise Server for SAP Applications 15 SP2:rabbitmq-server-plugins SUSE Linux Enterprise Server for SAP Applications 15 SP3:erlang-rabbitmq-client SUSE Linux Enterprise Server for SAP Applications 15 SP3:rabbitmq-server SUSE Linux Enterprise Server for SAP Applications 15 SP3:rabbitmq-server-plugins SUSE Linux Enterprise Server for SAP Applications 15 SP4:erlang-rabbitmq-client SUSE Linux Enterprise Server for SAP Applications 15 SP4:rabbitmq-server SUSE Linux Enterprise Server for SAP Applications 15 SP4:rabbitmq-server-plugins SUSE Manager Proxy 4.1:rabbitmq-server SUSE Manager Proxy 4.2:erlang-rabbitmq-client SUSE Manager Proxy 4.2:rabbitmq-server SUSE Manager Proxy 4.2:rabbitmq-server-plugins SUSE Manager Proxy 4.3:erlang-rabbitmq-client SUSE Manager Proxy 4.3:rabbitmq-server SUSE Manager Proxy 4.3:rabbitmq-server-plugins SUSE Manager Retail Branch Server 4.1:rabbitmq-server SUSE Manager Retail Branch Server 4.2:erlang-rabbitmq-client SUSE Manager Retail Branch Server 4.2:rabbitmq-server SUSE Manager Retail Branch Server 4.2:rabbitmq-server-plugins SUSE Manager Retail Branch Server 4.3:erlang-rabbitmq-client SUSE Manager Retail Branch Server 4.3:rabbitmq-server SUSE Manager Retail Branch Server 4.3:rabbitmq-server-plugins SUSE Manager Server 4.1:rabbitmq-server SUSE Manager Server 4.2:erlang-rabbitmq-client SUSE Manager Server 4.2:rabbitmq-server SUSE Manager Server 4.2:rabbitmq-server-plugins SUSE Manager Server 4.3:erlang-rabbitmq-client SUSE Manager Server 4.3:rabbitmq-server SUSE Manager Server 4.3:rabbitmq-server-plugins SUSE OpenStack Cloud 6:rabbitmq-server SUSE OpenStack Cloud 6:rabbitmq-server-plugins SUSE OpenStack Cloud 7:rabbitmq-server SUSE OpenStack Cloud 7:rabbitmq-server-plugins openSUSE Leap 15.5:erlang-rabbitmq-client openSUSE Leap 15.5:rabbitmq-server openSUSE Leap 15.5:rabbitmq-server-plugins openSUSE Leap 15.6:erlang-rabbitmq-client openSUSE Leap 15.6:rabbitmq-server openSUSE Leap 15.6:rabbitmq-server-plugins moderate 3 AV:L/AC:M/Au:S/C:P/I:P/A:N 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N