Description

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.

INFO

Published Date :

Nov. 23, 2019, 12:15 a.m.

Last Modified :

April 2, 2025, 2:13 p.m.

Remotely Exploitable :

Yes !

Impact Score :

3.6

Exploitability Score :

3.9
Public PoC/Exploit Available at Github

CVE-2019-11287 has a 1 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2019-11287 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Fedoraproject fedora
1 Debian debian_linux
1 Redhat openstack
1 Pivotal_software rabbitmq
1 Vmware rabbitmq
1 Broadcom rabbitmq_server
References to Advisories, Solutions, and Tools

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

CVE-2019-11287: DoS via Heap Overflow in RabbitMQ Web Management Plugin

0-day authenticated cve cve-2019-11287 cves denial-of-service

Updated: 3 weeks, 1 day ago
0 stars 0 fork 0 watcher
Born at : Feb. 12, 2025, 5:28 p.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2019-11287 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2019-11287 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CPE Deprecation Remap by [email protected]

    Apr. 02, 2025

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:a:vmware:rabbitmq:*:*:*:*:*:*:*:* versions from (including) 3.8.0 from (excluding) 3.8.1 OR *cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:* versions from (including) 3.8.0 from (excluding) 3.8.1
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference https://access.redhat.com/errata/RHSA-2020:0078
    Added Reference https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-11287-DoS%20via%20Heap%20Overflow-RabbitMQ%20Web%20Management%20Plugin
    Added Reference https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html
    Added Reference https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEQ6O7PMNJKYFMQYHAB55L423GYK63SO/
    Added Reference https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYTGR3D5FW2O25RXZOTIZMOD2HAUVBE4/
    Added Reference https://pivotal.io/security/cve-2019-11287
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Nov. 07, 2023

    Action Type Old Value New Value
    Added Reference Pivotal Software, Inc. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEQ6O7PMNJKYFMQYHAB55L423GYK63SO/ [No types assigned]
    Added Reference Pivotal Software, Inc. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYTGR3D5FW2O25RXZOTIZMOD2HAUVBE4/ [No types assigned]
    Removed Reference Pivotal Software, Inc. https://lists.fedoraproject.org/archives/list/[email protected]/message/PYTGR3D5FW2O25RXZOTIZMOD2HAUVBE4/
    Removed Reference Pivotal Software, Inc. https://lists.fedoraproject.org/archives/list/[email protected]/message/EEQ6O7PMNJKYFMQYHAB55L423GYK63SO/
  • Modified Analysis by [email protected]

    May. 15, 2022

    Action Type Old Value New Value
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html No Types Assigned https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html Third Party Advisory
    Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • CPE Deprecation Remap by [email protected]

    Mar. 17, 2022

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:a:pivotal_software:rabbitmq:*:*:*:*:*:*:*:* versions from (including) 3.8.0 from (excluding) 3.8.1 OR *cpe:2.3:a:vmware:rabbitmq:*:*:*:*:*:*:*:* versions from (including) 3.8.0 from (excluding) 3.8.1
  • CPE Deprecation Remap by [email protected]

    Aug. 04, 2021

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:a:redhat:openstack:15.0:*:*:*:*:*:*:* OR *cpe:2.3:a:redhat:openstack:15:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Jul. 19, 2021

    Action Type Old Value New Value
    Added Reference https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html [No Types Assigned]
  • Modified Analysis by [email protected]

    Oct. 09, 2020

    Action Type Old Value New Value
    Changed Reference Type https://access.redhat.com/errata/RHSA-2020:0078 No Types Assigned https://access.redhat.com/errata/RHSA-2020:0078 Third Party Advisory
    Changed Reference Type https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-11287-DoS%20via%20Heap%20Overflow-RabbitMQ%20Web%20Management%20Plugin No Types Assigned https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-11287-DoS%20via%20Heap%20Overflow-RabbitMQ%20Web%20Management%20Plugin Exploit, Third Party Advisory
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/EEQ6O7PMNJKYFMQYHAB55L423GYK63SO/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/EEQ6O7PMNJKYFMQYHAB55L423GYK63SO/ Third Party Advisory
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/PYTGR3D5FW2O25RXZOTIZMOD2HAUVBE4/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/PYTGR3D5FW2O25RXZOTIZMOD2HAUVBE4/ Third Party Advisory
    Removed CWE NIST CWE-400
    Added CWE NIST CWE-134
    Added CPE Configuration OR *cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:redhat:openstack:15.0:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Jan. 15, 2020

    Action Type Old Value New Value
    Added Reference https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-11287-DoS%20via%20Heap%20Overflow-RabbitMQ%20Web%20Management%20Plugin [No Types Assigned]
  • CVE Modified by [email protected]

    Jan. 13, 2020

    Action Type Old Value New Value
    Added Reference https://access.redhat.com/errata/RHSA-2020:0078 [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 07, 2019

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/PYTGR3D5FW2O25RXZOTIZMOD2HAUVBE4/ [No Types Assigned]
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/EEQ6O7PMNJKYFMQYHAB55L423GYK63SO/ [No Types Assigned]
  • Initial Analysis by [email protected]

    Dec. 04, 2019

    Action Type Old Value New Value
    Added CVSS V2 NIST (AV:N/AC:L/Au:N/C:N/I:N/A:P)
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    Changed Reference Type https://pivotal.io/security/cve-2019-11287 No Types Assigned https://pivotal.io/security/cve-2019-11287 Vendor Advisory
    Added CWE NIST CWE-400
    Added CPE Configuration OR *cpe:2.3:a:pivotal_software:rabbitmq:*:*:*:*:*:pivotal_cloud_foundry:*:* versions from (including) 1.16.0 up to (excluding) 1.16.7 *cpe:2.3:a:pivotal_software:rabbitmq:*:*:*:*:*:pivotal_cloud_foundry:*:* versions from (including) 1.17.0 up to (excluding) 1.17.4 *cpe:2.3:a:pivotal_software:rabbitmq:*:*:*:*:*:*:*:* versions from (including) 3.7.0 up to (excluding) 3.7.21 *cpe:2.3:a:pivotal_software:rabbitmq:*:*:*:*:*:*:*:* versions from (including) 3.8.0 up to (excluding) 3.8.1
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2019-11287 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.94 }} -1.39%

score

0.74279

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
© cvefeed.io
Latest DB Update: Apr. 30, 2025 4:14