Threats affecting pkg:maven/org.apache.rocketmq/rocketmq

CVE-2023-33246 is a critical remote code execution vulnerability in Apache RocketMQ versions 5.1.0 and below. The vulnerability arises because several RocketMQ components exposed on the extranet lack proper permission verification, allowing attackers to exploit the update configuration function or forge protocol content to execute arbitrary commands with the privileges of the RocketMQ process. This flaw affects NameServer, Broker, and Controller components. No authentication or user interaction is required, and the vulnerability has a CVSS score of 9.8, indicating a severe risk to confidentiality, integrity, and availability. Users are strongly advised to upgrade to RocketMQ 5.1.1 or above, or 4.