← Menace / CVE-2023-33246
CVE-2023-33246
Critique
Apache RocketMQ Command Execution Vulnerability.
Apache · RocketMQ
Exploitabilité (EPSS)
96.6 %
percentile mondial 100
Sévérité (CVSS)
9.8
CVSS v3.1
Ajoutée au KEV
06 sept. 2023
échéance CISA · 27 sept. 2023
Description
Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.
Action requise (CISA)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Familles de faiblesses
CWE-94 · Injection de code
Signal de priorisation (inspiré SSVC)
Examiner rapidement
Exploitation
Active (catalogue KEV)
Active (catalogue KEV)
Automatisable
Inconnu
Inconnu
Impact technique
Total
Total
Orientation, pas une décision : le 4ᵉ facteur SSVC (impact mission/société) dépend du contexte de votre organisation. Méthode ↗