CVE-2023-37582 in the critical feed json
Apache RocketMQ: Possible remote code execution when using the update configuration function
published 2023-07-12 3 y ago modified 2026-06-17 4 mo ago also GHSA-gpq8-963w-8qc9 , EUVD-2023-2067
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 90.4%
- EPSS 90.4% chance of exploitation in 30 days, percentile 99.8%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1.
When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as.
It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.
Patch / fix
- maven org.apache.rocketmq:rocketmq-namesrv 4.9.7, 5.1.2
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
90.43% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Apache RocketMQ - Remote Command Execution nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.rocketmq:rocketmq-namesrv | <4.9.7 >=5.0.0, <5.1.2 |
4.9.7 5.1.2 |
Affected products
- Apache Software Foundation Apache RocketMQ
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
lists.apache.org
/thread/m614czxtpvlztd7mfgcs2xcsg36rdbnc
vendor-advisory, web, mailing-list, patch
-
openwall.com
/lists/oss-security/2023/07/12/1
web, mailing-list, patch, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-37582
advisory
-
github.com
/apache/rocketmq
package
Sources
- CVE List CVE-2023-37582
- GitHub Advisory GHSA-gpq8-963w-8qc9
- NVD CVE-2023-37582
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.