CyberRota Analysis
AI-GeneratedRabbitMQ versions prior to 4.1.13, 4.2.7, and 4.3.0 have a vulnerability where a monitoring-tagged user can reset authentication attempt counters via a DELETE request, potentially erasing evidence of brute-force attacks. Although the impact is primarily cosmetic, it creates a security inconsistency since a similar operation requires administrator privileges. Organizations using RabbitMQ with the Management plugin enabled should prioritize upgrading to the fixed versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is_authorized/2 uses is_authorized_monitor for all methods. DELETE resets rabbit_core_metrics:reset_auth_attempt_metrics(). Impact is cosmetic (counters only, no log erasure), but inconsistent with rabbit_mgmt_wm_reset.erl which requires admin for the analogous operation. A monitoring-tagged user can reset the per-node authentication-attempt counters via DELETE /api/auth/attempts/:node, erasing evidence of brute-force activity. The sibling endpoint wm_reset requires administrator. Preconditions include Management plugin enabled monitoring tag. This issue is fixed in versions 4.1.13, 4.2.7, and 4.3.0.