Vulnerability in Pivotal Rabbitmq For Pcf
CVE-2018-1279
Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports on any server in the MQ cluster can use this cookie to gain full control over the entire cluster.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.5 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.018 (78.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 79th percentile — 78.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.018 · newest: 0.018 · change: 0.000
Affected products
- Pivotal Rabbitmq For Pcf — versions 1
- Pivotal Software Rabbitmq
Weakness classification (CWE)
Public proof-of-concept exploits
References
- pivotal.io/security/cve-2018-1279 (Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-1279?
- CVE-2018-1279 is a high-severity vulnerability in Pivotal Rabbitmq For Pcf, classified under Use of Insufficiently Random Values. CVSS score: 8.5/10. Published 2018-12-10.
- How severe is CVE-2018-1279?
- High severity. CVSS v3 base score is 8.5 out of 10.
- Is CVE-2018-1279 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.