CyberRota Analysis
AI-GeneratedThe RabbitMQ Java client library prior to version 5.35.0 is vulnerable due to the inclusion of plaintext AMQP URI credentials in wrapped exceptions when URI parsing fails. This can lead to unauthorized disclosure of sensitive broker credentials in logs and monitoring systems, potentially compromising security. Organizations using affected versions of the RabbitMQ Java client should prioritize upgrading to version 5.35.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, startup logs, application performance monitoring systems, CI logs, and copied stack traces can disclose broker credentials to users who should not have access to them. This issue is fixed in version 5.35.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)