CVE-2024-51988

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configure` permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host & 3. HTTP API access. could delete queues it had no (deletion) permissions for. This issue has been addressed in version 3.12.11 of the open source rabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the tanzu release. Users are advised to upgrade. Users unable to upgrade may disable management plugin and use, for example, Prometheus and Grafana for monitoring.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Nov 6, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-519897.1Password Pusher is an open source application to communicate sensitive information over the web. A cross-site scripting (XSS) vulnerability CVE-2024-51995.4The Spotify Play Button WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them ba CVE-2024-519909.3jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write fil CVE-2024-519914.9October is a Content Management System (CMS) and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrato CVE-2024-519924.1Orchid is a @laravel package that allows for rapid application development of back-office applications, admin/user panels, and dashboards. T CVE-2024-519933.4Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misc CVE-2024-519945.4Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal CVE-2024-519957.1Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want as long as we specify an `operation` tha CVE-2024-519967.5Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me CVE-2024-519978.1Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART (**Attestation Results Tok CVE-2024-519988.6changedetection.io is a free open source web page change detection tool. The validation for the file URI scheme falls short, and results in CVE-2024-52004.8The Postie WordPress plugin before 1.9.71 does not sanitise and escape some of its settings, which could allow high privilege users such as