{"action":"Upgrade org.apache.rocketmq:rocketmq-controller to 5.1.1 or later.","affected":[{"fixed":"5.1.1","introduced":"5.0.0"}],"component":"org.apache.rocketmq:rocketmq-controller","cve_ids":["CVE-2023-33246"],"ecosystem":"Maven","epss":0.96568,"exploited":true,"fixed_versions":["5.1.1"],"ghsa_id":"GHSA-x3cq-8f32-5f63","id":"tcs_01M5N9HM186F8CKMT82P5DWT2H","modified_at":"2025-10-22T19:24:49.375145Z","published_at":"2023-07-06T21:15:04Z","references":["https://osv.dev/vulnerability/GHSA-x3cq-8f32-5f63","https://nvd.nist.gov/vuln/detail/CVE-2023-33246","https://github.com/apache/rocketmq/commit/9d411cf04a695e7a3f41036e8377b0aa544d754d","https://github.com/apache/rocketmq/commit/c3ada731405c5990c36bf58d50b3e61965300703","https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT","https://github.com/apache/rocketmq","https://github.com/jakabakos/CVE-2023-33246_Apache_RocketMQ_RCE","https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33246","https://www.vicarius.io/vsociety/posts/rocketmq-rce-cve-2023-33246-33247","http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html","http://www.openwall.com/lists/oss-security/2023/07/12/1"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-x3cq-8f32-5f63#Maven/org.apache.rocketmq:rocketmq-controller","url":"https://osv.dev/vulnerability/GHSA-x3cq-8f32-5f63"},{"source":"kev","source_id":"CVE-2023-33246","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"Apache RocketMQ may have remote code execution vulnerability when using update configuration function"}