CVE-2018-1279
CVSS V2 Low 3.3
CVSS V3 Medium 6.5
Description
Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports on any server in the MQ cluster can use this cookie to gain full control over the entire cluster.
Overview
- CVE ID
- CVE-2018-1279
- Assigner
- security_alert@emc.com
- Vulnerability Status
- Modified
- Published Version
- 2018-12-10T19:29:25
- Last Modified Date
- 2019-10-09T23:38:18
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:pivotal_software:rabbitmq:*:*:*:*:*:pivotal_cloud_foundry:*:* | 1 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:A/AC:L/Au:N/C:P/I:N/A:N
- Access Vector
- ADJACENT_NETWORK
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- NONE
- Availability Impact
- NONE
- Base Score
- 3.3
- Severity
- LOW
- Exploitability Score
- 6.5
- Impact Score
- 2.9
CVSS Version 3
- Version
- 3.0
- Vector String
- CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack Vector
- ADJACENT_NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- NONE
- Base Score
- 6.5
- Base Severity
- MEDIUM
- Exploitability Score
- 2.8
- Impact Score
- 3.6
References
| Reference URL | Reference Tags |
|---|---|
| https://pivotal.io/security/cve-2018-1279 | Mitigation Vendor Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2018-1279 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1279 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 17:04:59 | Added to TrackCVE | |||
| 2022-12-03 15:11:55 | secure@dell.com | security_alert@emc.com | CVE Assigner | updated |
| 2022-12-03 15:11:55 | 2018-12-10T19:29Z | 2018-12-10T19:29:25 | CVE Published Date | updated |
| 2022-12-03 15:11:55 | 2019-10-09T23:38:18 | CVE Modified Date | updated | |
| 2022-12-03 15:11:55 | Modified | Vulnerability Status | updated |