CVE-2021-32718: 
NixOS vulnerability analysis and mitigation

RabbitMQ, a multi-protocol messaging broker, contained a Cross-Site Scripting (XSS) vulnerability (CVE-2021-32718) in versions prior to 3.8.17. The vulnerability was discovered in the management UI where a new user's name was rendered in a confirmation message without proper tag sanitization (GitHub Advisory).

The vulnerability was identified as an improper neutralization of script-related HTML tags in the web page (Basic XSS) within the RabbitMQ management UI. When adding a new user via the management interface, the username was displayed in a confirmation message without proper sanitization of HTML tags, potentially allowing JavaScript code execution in the context of the page. The vulnerability has been assigned a CVSS v3.1 base score of 3.1 (Low) with the vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N (GitHub Advisory).

The vulnerability could allow an attacker to perform cross-site scripting attacks and potentially execute JavaScript code in the context of the management UI. However, the impact is limited as the attacker must be signed in and have elevated permissions for user management (GitHub Advisory).

The vulnerability requires an authenticated user with elevated permissions (user management capabilities) to exploit. The attack complexity is considered high, and user interaction is required for successful exploitation (GitHub Advisory).

The vulnerability was patched in RabbitMQ version 3.8.17. As a workaround, users can disable the rabbitmq_management plugin and use CLI tools for management operations. Additionally, Prometheus and Grafana can be used for metrics and monitoring purposes (GitHub Advisory, NVD).