CVE-2024-23321

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-23321
For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and authorization functions. An attacker, possessing regular user privileges or listed in the IP whitelist, could potentially acquire the administrator's account and password through specific interfaces. Such an action would grant them full control over RocketMQ, provided they have access to the broker IP address list. To mitigate these security threats, it is strongly advised that users upgrade to version 5.3.0 or newer. Additionally, we recommend users to use RocketMQ ACL 2.0 instead of the original RocketMQ ACL when upgrading to version Apache RocketMQ 5.3.0.

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/07/22/1 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/22/1 Mailing List
https://lists.apache.org/thread/lr8npobww786nrnddd1pcy974r17c830 Mailing List Vendor Advisory
https://lists.apache.org/thread/lr8npobww786nrnddd1pcy974r17c830 Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:rocketmq:*:*:*:*:*:*:*:*
History

13 Feb 2025, 18:17

Type Values Removed Values Added
Summary For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and authorization functions. An attacker, possessing regular user privileges or listed in the IP whitelist, could potentially acquire the administrator's account and password through specific interfaces. Such an action would grant them full control over RocketMQ, provided they have access to the broker IP address list. To mitigate these security threats, it is strongly advised that users upgrade to version 5.3.0 or newer. Additionally, we recommend users to use RocketMQ ACL 2.0 instead of the original RocketMQ ACL when upgrading to version Apache RocketMQ 5.3.0. For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and authorization functions. An attacker, possessing regular user privileges or listed in the IP whitelist, could potentially acquire the administrator's account and password through specific interfaces. Such an action would grant them full control over RocketMQ, provided they have access to the broker IP address list. To mitigate these security threats, it is strongly advised that users upgrade to version 5.3.0 or newer. Additionally, we recommend users to use RocketMQ ACL 2.0 instead of the original RocketMQ ACL when upgrading to version Apache RocketMQ 5.3.0.

10 Sep 2024, 15:15

Type Values Removed Values Added
CPE cpe:2.3:a:apache:rocketmq:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CWE CWE-200 NVD-CWE-noinfo
First Time Apache rocketmq
Apache
References () https://lists.apache.org/thread/lr8npobww786nrnddd1pcy974r17c830 - () https://lists.apache.org/thread/lr8npobww786nrnddd1pcy974r17c830 - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/22/1 - () http://www.openwall.com/lists/oss-security/2024/07/22/1 - Mailing List

22 Jul 2024, 14:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/22/1 -

22 Jul 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-22 10:15

Updated : 2025-02-13 18:17

NVD link : CVE-2024-23321

Mitre link : CVE-2024-23321

JSON object : View

Products Affected

apache

  • rocketmq
CWE
NVD-CWE-noinfo