RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user's browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.

Security Update for Vmware RabbitMQ

The version of rabbitmq-server installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-30219 advisory.

  - RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated     attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file     modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users.
    When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a     notification) in the management UI. The error message includes virtual host name, which was not escaped     prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual     host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an     existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the     user's browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.
    (CVE-2025-30219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of rabbitmq-server installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-30219 advisory.

  - RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated     attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file     modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users.
    When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a     notification) in the management UI. The error message includes virtual host name, which was not escaped     prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual     host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an     existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the     user's browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.
    (CVE-2025-30219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by a vulnerability as referenced in the USN-7399-1 advisory.

    It was discovered that RabbitMQ Server's management UI did not sanitize certain input. An attacker could     possibly use this issue to inject code by performing a cross-site scripting (XSS) attack.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
234532	Azure Linux 3.0 Security Update: rabbitmq-server (CVE-2025-30219)	Nessus	Azure Linux Local Security Checks	medium
234064	CBL Mariner 2.0 Security Update: rabbitmq-server (CVE-2025-30219)	Nessus	MarinerOS Local Security Checks	medium
233577	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : RabbitMQ Server vulnerability (USN-7399-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2025-30219

medium

Tenable Plugins

Coming Soon

medium

medium

medium