Apache RocketMQ vulnerabilities

4 CVEs affecting Apache RocketMQ, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-23321, published 2024-07-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-33246: Apache RocketMQ Command Execution Vulnerability, published 2023-05-24. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-09-06. EPSS: 96.6% chance of exploitation in the next 30 days. For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are…
CVE-2023-37582, published 2023-07-12. Critical severity, CVSS 9.8. EPSS: 90.4% chance of exploitation in the next 30 days. The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the…
CVE-2019-17572, published 2020-05-14. Medium severity, CVSS 5.3. EPSS: 3% chance of exploitation in the next 30 days. In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a…
CVE-2024-23321, published 2024-07-22. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and…