Rocketmq vulnerabilities

3 known vulnerabilities in Rocketmq from Apache. 3 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Apache RocketMQ: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2024-23321Jul 22, 2024Apache

  For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and authorization functions. An attacker, possessing regular user pri

• 9.8 Critical severity

  Apache RocketMQ: Improper Control of Generation of Code

  CVE-2023-37582Jul 12, 2023ApacheEPSS 90.4%

  The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can exp

• 9.8 Critical severity

  Apache RocketMQ Command Execution Exploited

  CVE-2023-33246May 24, 2023ApacheEPSS 96.6%

  For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker