View at Official suse advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2019-11291 severity moderate: SUSE including 2 source package names (rabbitmq-server, rabbitmq-server-plugins), 16 product×package rows across 9 product lines (HPE Helion OpenStack 8, HPE Helion OpenStack Cloud 8, … (9 product lines)): Known Not Affected 16.
Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.