RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing attackers with sufficient local filesystem permissions to add arbitrary plugins.

Related CVEs

CVE-2021-22117

Key Information

GHSA ID

GHSA-rwr9-36p6-24vw

Published

May 24, 2022 7:02 PM

Last Modified

October 25, 2022 7:00 PM

CVSS Score

7.5 /10

Primary Ecosystem

Unknown

Primary Package

Unknown

GitHub Reviewed

✗ No

Dataset

Last updated: September 29, 2025 6:31 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.