RabbitMQ-server versions before 4.2.5 have an improper neutralization of input during web page generation (CWE-79) in the management UI. Specifically, the x-internal-purpose argument for queues or exchanges is embedded into an HTML title attribute without proper escaping on the Queues and Exchanges pages. This flaw enables a user with queue or exchange declaration permissions to inject JavaScript code that executes in the browsers of other users viewing these pages. The vulnerability has a CVSS 4.0 score of 7.1, indicating high severity. The issue is resolved in version 4.2.5.

An attacker with permission to declare queues or exchanges can exploit this vulnerability to execute arbitrary JavaScript in the browser of other users who access the affected management UI pages. This can lead to session hijacking, information disclosure, or other malicious actions within the context of the victim's browser session. There are no known exploits in the wild at this time.

Upgrade RabbitMQ-server to version 4.2.5 or later, where this vulnerability is fixed. Since this is a self-hosted product, administrators must apply the update themselves. Patch status is confirmed by the vendor advisory indicating the fix in 4.2.5. No other mitigations are specified.