RabbitMQ-server versions >= 3.7.0 and < 4.0.13, and >= 4.1.0-alpha and < 4.1.2 contain a CWE-80 vulnerability involving improper neutralization of script-related HTML tags, leading to basic cross-site scripting (XSS). This vulnerability allows an attacker to inject malicious scripts into web pages served by RabbitMQ, potentially impacting users who interact with the affected web interface. The issue has been addressed in versions 4.0.13 and 4.1.2. The CVSS 4.0 vector indicates network attack vector, high attack complexity, required privileges, user interaction, and high vulnerability conditions. No official remediation level or patch links are provided in the data, but fixed versions are known.

Successful exploitation could allow an attacker with high privileges and requiring user interaction to execute script code in the context of the RabbitMQ web interface. This could lead to unauthorized actions or information disclosure within the scope of the affected web application. The medium CVSS score reflects moderate impact and exploit complexity. There are no known exploits in the wild at this time.

Upgrade affected RabbitMQ-server installations to version 4.0.13 or later, or 4.1.2 or later, where this vulnerability is fixed. Since no official patch links or advisories are provided, verify the upgrade path and consult RabbitMQ vendor resources for official guidance. Patch status is not explicitly confirmed beyond the fixed version numbers; check the vendor advisory for current remediation details before deployment.