CVE-2017-4966 Information disclosure in Pivotal RabbitMQ
Attackers can retrieve stored user credentials from browser local storage in RabbitMQ management UI, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-4966?
CVE-2017-4966 is a high-severity vulnerability in Broadcom Rabbitmq Server, published on 13 Jun 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user credentials in a browser's local storage without expiration, making it possible to retrieve them using a chained attack.
Weakness: CWE-200
Which versions are affected by CVE-2017-4966?
It affects 3 products.
Products include Broadcom Rabbitmq Server, Debian Debian Linux, Pivotal Software Rabbitmq.
How do I fix CVE-2017-4966?
Upgrade to a fixed version.
Is CVE-2017-4966 being exploited?
There is no known exploitation of CVE-2017-4966 in the wild and no public exploit code.
Other vulnerabilities in Broadcom Rabbitmq Server
- CVE-2016-9877 Auth bypass in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7
- CVE-2026-67404 RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch
- CVE-2026-67231 RabbitMQ: Trust-store whitelist by Issuer+Serial only
- CVE-2026-57219 Information disclosure in rabbitmq-server
- CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login
Sources
Also known as DEBIAN-CVE-2017-4966, GHSA-cp6g-c34h-69q7, UBUNTU-CVE-2017-4966, USN-6265-1.