VULNERABILITY INTELLIGENCE

CVE-2018-1279

CVSS score8.5 HIGH
EPSS probability1.83%
CISA KEVNot currently listed
Published2018-12-10
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Description

Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports on any server in the MQ cluster can use this cookie to gain full control over the entire cluster.

Weakness classification

  • CWE-330: Use of Insufficiently Random Values

Primary references