Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-fn32-basw-9yg2
Vulnerability ID VCID-fn32-basw-9yg2
Aliases CVE-2023-33246
GHSA-x3cq-8f32-5f63
Summary For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution.  Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content.  To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .
Status Published
Exploitability 2.0
Weighted Severity 9.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 9.8 http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html
cvssv3.1 9.8 http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html
generic_textual CRITICAL http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html
ssvc Act http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html
cvssv3 9.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-33246.json
epss 0.94388 https://api.first.org/data/v1/epss?cve=CVE-2023-33246
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-x3cq-8f32-5f63
cvssv3.1 9.8 https://github.com/apache/rocketmq
generic_textual CRITICAL https://github.com/apache/rocketmq
cvssv3.1 9.8 https://github.com/apache/rocketmq/commit/9d411cf04a695e7a3f41036e8377b0aa544d754d
generic_textual CRITICAL https://github.com/apache/rocketmq/commit/9d411cf04a695e7a3f41036e8377b0aa544d754d
cvssv3.1 9.8 https://github.com/apache/rocketmq/commit/c3ada731405c5990c36bf58d50b3e61965300703
generic_textual CRITICAL https://github.com/apache/rocketmq/commit/c3ada731405c5990c36bf58d50b3e61965300703
cvssv3.1 9.8 https://github.com/jakabakos/CVE-2023-33246_Apache_RocketMQ_RCE
generic_textual CRITICAL https://github.com/jakabakos/CVE-2023-33246_Apache_RocketMQ_RCE
cvssv3.1 9.8 https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT
generic_textual CRITICAL https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT
cvssv3.1 9.8 https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp
cvssv3.1 9.8 https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp
generic_textual CRITICAL https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp
ssvc Act https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2023-33246
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2023-33246
cvssv3.1 9.8 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33246
generic_textual CRITICAL https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33246
cvssv3.1 9.8 https://www.vicarius.io/vsociety/posts/rocketmq-rce-cve-2023-33246-33247
generic_textual CRITICAL https://www.vicarius.io/vsociety/posts/rocketmq-rce-cve-2023-33246-33247
cvssv3.1 9.8 http://www.openwall.com/lists/oss-security/2023/07/12/1
cvssv3.1 9.8 http://www.openwall.com/lists/oss-security/2023/07/12/1
generic_textual CRITICAL http://www.openwall.com/lists/oss-security/2023/07/12/1
ssvc Act http://www.openwall.com/lists/oss-security/2023/07/12/1
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-33246.json
https://api.first.org/data/v1/epss?cve=CVE-2023-33246
https://github.com/apache/rocketmq
https://github.com/apache/rocketmq/commit/9d411cf04a695e7a3f41036e8377b0aa544d754d
https://github.com/apache/rocketmq/commit/c3ada731405c5990c36bf58d50b3e61965300703
https://github.com/jakabakos/CVE-2023-33246_Apache_RocketMQ_RCE
https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT
https://nvd.nist.gov/vuln/detail/CVE-2023-33246
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33246
https://www.vicarius.io/vsociety/posts/rocketmq-rce-cve-2023-33246-33247
1 http://www.openwall.com/lists/oss-security/2023/07/12/1
1s8j2c8kogthtpv3060yddk03zq0pxyp https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp
2317265 https://bugzilla.redhat.com/show_bug.cgi?id=2317265
Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html
GHSA-x3cq-8f32-5f63 https://github.com/advisories/GHSA-x3cq-8f32-5f63
Data source Metasploit
Description RocketMQ versions 5.1.0 and below are vulnerable to Arbitrary Code Injection. Broker component of RocketMQ is leaked on the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content.
Note 
Stability:
  - crash-safe
SideEffects:
  - artifacts-on-disk
  - config-changes
Reliability:
  - repeatable-session
Ransomware campaign use Unknown
Source publication date May 23, 2023
Platform Linux,Unix
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/apache_rocketmq_update_config.rb
Data source KEV
Date added Sept. 6, 2023
Description Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.
Required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due date Sept. 27, 2023
Note 
https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp;  https://nvd.nist.gov/vuln/detail/CVE-2023-33246
Ransomware campaign use Unknown
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H Found at http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T20:30:17Z/ Found at http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-33246.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H Found at https://github.com/apache/rocketmq
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H Found at https://github.com/apache/rocketmq/commit/9d411cf04a695e7a3f41036e8377b0aa544d754d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H Found at https://github.com/apache/rocketmq/commit/c3ada731405c5990c36bf58d50b3e61965300703
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H Found at https://github.com/jakabakos/CVE-2023-33246_Apache_RocketMQ_RCE
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H Found at https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H Found at https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T20:30:17Z/ Found at https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-33246
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H Found at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33246
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H Found at https://www.vicarius.io/vsociety/posts/rocketmq-rce-cve-2023-33246-33247
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H Found at http://www.openwall.com/lists/oss-security/2023/07/12/1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://www.openwall.com/lists/oss-security/2023/07/12/1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T20:30:17Z/ Found at http://www.openwall.com/lists/oss-security/2023/07/12/1
Exploit Prediction Scoring System (EPSS)
Percentile 0.99973
EPSS Score 0.94388
Published At June 13, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:26:50.584214+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2023/33xxx/CVE-2023-33246.json 38.6.0