RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user's browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1548-1 advisory.

    - CVE-2025-30219: incorrectly escaped virtual hostname present in error message could lead to XSS attack.
    (bsc#1240071)

    Non-security fixes:

    - Require rabbitmq-server313-plugins rather then rabbitmq-server-plugins. (bsc#1231656, bsc#1234763)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1466-1 advisory.

    - CVE-2025-30219: Fixed XSS in an error message in Management UI (bsc#1240071)

    Other fixes:
    - Disable parallel make, this causes build failures

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user's browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of rabbitmq-server installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-30219 advisory.

  - RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated     attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file     modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users.
    When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a     notification) in the management UI. The error message includes virtual host name, which was not escaped     prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual     host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an     existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the     user's browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.
    (CVE-2025-30219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of rabbitmq-server installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-30219 advisory.

  - RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated     attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file     modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users.
    When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a     notification) in the management UI. The error message includes virtual host name, which was not escaped     prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual     host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an     existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the     user's browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.
    (CVE-2025-30219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by a vulnerability as referenced in the USN-7399-1 advisory.

    It was discovered that RabbitMQ Server's management UI did not sanitize certain input. An attacker could     possibly use this issue to inject code by performing a cross-site scripting (XSS) attack.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
236795	SUSE SLES15 / openSUSE 15 Security Update : rabbitmq-server313 (SUSE-SU-2025:1548-1)	Nessus	SuSE Local Security Checks	medium
235633	SUSE SLES15 / openSUSE 15 Security Update : rabbitmq-server (SUSE-SU-2025:1466-1)	Nessus	SuSE Local Security Checks	medium
235082	RabbitMQ < 3.13.8 / 4.0.x < 4.0.3 XSS (GHSA-g58g-82mw-9m3p)	Nessus	Misc.	medium
234532	Azure Linux 3.0 Security Update: rabbitmq-server (CVE-2025-30219)	Nessus	Azure Linux Local Security Checks	medium
234064	CBL Mariner 2.0 Security Update: rabbitmq-server (CVE-2025-30219)	Nessus	MarinerOS Local Security Checks	medium
233577	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : RabbitMQ Server vulnerability (USN-7399-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2025-30219

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium