CVE-2024-51988 - CVE House
Back to Database
Status published Medium CVE-2024-51988

HTTP API's queue deletion endpoint does not verify that the user has a required permission

Vulnerability Description

RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configure` permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host & 3. HTTP API access. could delete queues it had no (deletion) permissions for. This issue has been addressed in version 3.12.11 of the open source rabbitMQ release and in versions 1.5.2, 3.13.0, and 4.0.0 of the tanzu release. Users are advised to upgrade. Users unable to upgrade may disable management plugin and use, for example, Prometheus and Grafana for monitoring.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-51988

Credits & Attribution

No credits recorded in the NVD database.

References

More from rabbitmq

View All →
CVE-2025-50200
RabbitMQ Node can log Basic Auth header from an HTTP request
Medium 6.7
CVE-2025-30219
RabbitMQ has XSS Vulnerability in an Error Message in Management UI
Medium 6.1
CVE-2023-46120
RabbitMQ Java client's lack of message size limitation leads to remote DoS attack
Medium 4.9
CVE-2023-46118
Denial of Service by publishing large messages over the HTTP API
Medium 4.9
CVE-2022-31008
Predictable credential obfuscation seed value used in rabbitmq-server
Medium 5.5

Affected Vendor

Affected Software

rabbitmq-server
Vulnerable Versions:
Open source RabbitMQ: >= 3.12.7, < 3.12.11, Tanzu RabbitMQ: >= 2.0.0, < 3.13.0, Tanzu RabbitMQ: < 1.5.2

Timeline

Official Publish: November 6th, 2024
Last Modified: November 6th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-284

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1078 Valid Accounts
Persistence
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact