CVE-2023-33246

Severity CVSS v4.0:

Pending analysis

Type:

CWE-94 Code Injection

Publication date:

24/05/2023

Last modified:

06/03/2025

Description

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. <br /> <br /> Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. <br /> <br /> To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v3.1 Severity and Metrics:

Base Score: 9.80 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): High

Base Score 3.x

9.80

Severity 3.x

CRITICAL

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:apache:rocketmq::::::::		4.9.6 (excluding)
cpe:2.3:a:apache:rocketmq::::::::	5.0.0 (including)	5.1.1 (excluding)

To consult the complete list of CPE names with products and versions, see this page

CVE-2023-33246

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools