high6.5
CVE-2024-51988
RabbitMQ HTTP API's queue deletion endpoint does not verify that the user has a required permission
Impact
### Summary Queue deletion via the HTTP API was not verifying the `configure` permission of the user. ### Impact Users who had all of the following: 1. Valid credentials 2. Some permissions for the target virtual host 3. HTTP API access could delete queues it had no (deletion) permissions for. ### Workarounds Disable management plugin and use, for example, [Prometheus and Grafana](https://www.rabbitmq.com/docs/prometheus) for monitoring. ### OWASP Classification OWASP Top10 A01:2021 – Broken Access Control
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| erlang | rabbit_common | >= 3.12.7, < 3.12.11 | 3.12.11 |