Skip to content
OpenAdvisories

Package · Maven

org.apache.rocketmq:rocketmq-broker

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.8
    CVE-2023-33246 Exploited Public exploit Scanner template EPSS 97%

    Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

    For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution.  Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attack…

    Apache Software Foundation Apache RocketMQ org.apache.rocketmq:rocketmq-namesrv org.apache.rocketmq:rocketmq-broker Maven
    KEV Sep 6, 2023
  • Medium —
    CVE-2019-17572 Public exploit

    Directory traversal in Apache RocketMQ

    In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in broker…

    org.apache.rocketmq:rocketmq-broker Maven