Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2023-33246 Details

Description

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution.  Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content.  To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/jakabakos/CVE-2023-33246_Apache_RocketMQ_RCE CISA-ADPExploit
https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT CISA-ADPExploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33246 CISA-ADPThird Party AdvisoryUS Government Resource
http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html CVEExploitThird Party AdvisoryVDB Entry
https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp CVEMailing ListVendor Advisory

see all 10 references

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Vulnerability NameDate AddedDue DateRequired Action
Apache RocketMQ Command Execution VulnerabilitySep 6, 2023Sep 27, 2023Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weakness Enumeration

CWE-IDCWE NameSource
CWE-94Improper Control of Generation of Code ('Code Injection')[email protected]

Affected Products

ProductVersions
apache rocketmq
< 4.9.6
>= 5.0.0, < 5.1.1

CPE

  • cpe:2.3:a:apache:rocketmq:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

16 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2023-33246
NVD Published Date:
May 24, 2023
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]