Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.apache.rocketmq:rocketmq-controller

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8Exploited · CISA KEVMavenPublished

    Apache RocketMQ may have remote code execution vulnerability when using update configuration function

    CVE-2023-33246 · GHSA-x3cq-8f32-5f63

    Affected
    • Maven org.apache.rocketmq:rocketmq-controller >= 5.0.0, < 5.1.1
    Fixed in
    5.1.1· Vendor fix available
    Issue
    For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .

    Recommended action: Upgrade to 5.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)cisa.gov (2)Source checked Evidence →