CVSS 3.1
5.9 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2018-11087
Medium (5.9). EPSS 1.2% chance of exploitation in the next 30 days. Fixed in org.springframework.amqp:spring-amqp 1.7.10, 2.0.6.
Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
- CWE
- CWE-295
- Published
- Modified
- Record from
- the NVD, synced
Affected
- pivotal_software:spring_advanced_message_queuing_protocol
- vmware:rabbitmq_java_client
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-w4g2-9hj6-5472 | Maven | org.springframework.amqp:spring-amqp | >=2.0.0 <2.0.6 | 2.0.6 |
| GHSA-w4g2-9hj6-5472 | Maven | org.springframework.amqp:spring-amqp | <1.7.10 | 1.7.10 |
| GHSA-w4g2-9hj6-5472 | Maven | com.rabbitmq:amqp-client | <4.8.0 | 4.8.0 |
| GHSA-w4g2-9hj6-5472 | Maven | com.rabbitmq:amqp-client | >=5.0.0 <5.4.0 | 5.4.0 |