PT-2023-4093 · Apache · Rocketmq

Soreatu + 3 · Publicado 2023-07-12 · Atualizado 2025-10-16 · CVE-2023-37582

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RocketMQ versions prior to 4.9.7 RocketMQ versions prior to 5.1.2

Description The vulnerability in the RocketMQ NameServer component allows for remote command execution. This issue arises when NameServer addresses are exposed on the extranet without proper permission verification, enabling an attacker to exploit the vulnerability by using the update configuration function to execute commands as the system user that RocketMQ is running as.

Recommendations For RocketMQ 4.x, upgrade to version 4.9.7 or above. For RocketMQ 5.x, upgrade to version 5.1.2 or above.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2023-04396

CVE-2023-37582

GHSA-GPQ8-963W-8QC9

Produtos afetados

Rocketmq

Referências · 19

• 🔥 https://github.com/Malayke/CVE-2023-37582_EXPLOIT · Exploit
• https://github.com/apache/rocketmq · Nota
• https://bdu.fstec.ru/vul/2023-04396 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-37582 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/07/12/1 · Correção
• https://twitter.com/rst_cloud/status/1837592810800689402 · Publicação no Twitter
• https://twitter.com/E_S_Channel/status/1743631245861400730 · Publicação no Twitter
• https://t.me/cvenotify/54708 · Publicação no Telegram
• https://twitter.com/CCBalert/status/1749459161841013146 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-gpq8-963w-8qc9 · Aviso do Fabricante
• https://t.me/cybersecuritytechnologies/8677 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-37582 · Nota de Segurança
• https://t.me/pentestingnews/37613 · Publicação no Telegram
• https://twitter.com/pdnuclei_bot/status/1978747777548243092 · Publicação no Twitter
• https://t.me/proxy_bar/1626 · Publicação no Telegram