Summary
An authenticated user could access metadata in the broker they should not have access to.
Impact
- Read queue, exchange, and binding information from vhosts they should not have access to
- View message statistics for unauthorized vhosts
- Enumerate all vhosts configured on the server (brute force guessing)
- List all resources in a given vhost on the server
Workarounds
- Restrict Management API access to trusted administrators only
References
Summary
An authenticated user could access metadata in the broker they should not have access to.
Impact
Workarounds
References