Medium severity · published Nov 6, 2024
CVE-2024-51988
HTTP API's queue deletion endpoint does not verify that the user has a required permission
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configure` permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host & 3. HTTP API access. could delete queues it had no (deletion) permissions for. This issue has been addressed in version 3.12.11 of the open source rabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the tanzu release. Users are advised to upgrade. Users unable to upgrade may disable management plugin and use, for example, Prometheus and Grafana for monitoring.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
rabbitmq-server · rabbitmq
Open source RabbitMQ: >= 3.12.7, < 3.12.11; Tanzu RabbitMQ: >= 2.0.0, < 3.13.0; Tanzu RabbitMQ: < 1.5.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-51988
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-51988
github.com
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj33-75x5-32j4
www.rabbitmq.com
https://www.rabbitmq.com/docs/prometheus
More from rabbitmq-server
10.0
CVE-2026-57216
RabbitMQ: AMQP 1.0, AMQP 0-9-1, Stream Protocol loopback enforcement can lead to remote guest sessions due to listener-address loopback checks
10.0
CVE-2026-57211
RabbitMQ: UNC SSRF affecting the management UI on Windows
9.3
CVE-2026-67237
RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint
9.1
CVE-2026-67231
RabbitMQ: Trust-store whitelist by Issuer+Serial only
8.8
CVE-2026-66070
RabbitMQ: CORS * reflects Origin with Allow-Credentials