RabbitMQ server versions before 4.2.5 contain an XSS vulnerability (CWE-79) in the management UI. Specifically, the x-internal-purpose argument for queues or exchanges is rendered into an HTML title attribute without proper escaping on the Queues and Exchanges pages. This improper neutralization of input enables a user with queue or exchange declaration permissions to inject JavaScript code that executes in the browsers of other users viewing those pages. The vulnerability has a CVSS 4.0 base score of 7.1, indicating high severity. The vulnerability is resolved in RabbitMQ version 4.2.5.

An attacker with permission to declare queues or exchanges can inject malicious JavaScript code into the management UI, which will execute in the browsers of other users viewing the Queues and Exchanges pages. This can lead to session hijacking, unauthorized actions, or other client-side impacts. There is no indication of privilege escalation or server compromise from this vulnerability alone.

Upgrade RabbitMQ server to version 4.2.5 or later, where this XSS vulnerability is fixed. No other official remediation or temporary workaround is indicated. Since this is not a cloud service, users must apply the patch themselves.