-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unauthenticated configuration update endpoints in NameServer, Broker, and Controller components. The patch adds explicit checks for configuration path parameters (brokerConfigPath, configStorePath, kvConfigPath, configStorePathName) that were previously modifiable. These functions directly process configuration update requests and lacked critical parameter validation before the fix, enabling attackers to overwrite paths and execute commands through RocketMQ's configuration reload mechanism.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.rocketmq:rocketmq-broker | maven | >= 5.0.0, < 5.1.1 | 5.1.1 |
| org.apache.rocketmq:rocketmq-namesrv | maven | >= 4.0.0, < 4.9.6 | 4.9.6 |
| org.apache.rocketmq:rocketmq-controller | maven | >= 5.0.0, < 5.1.1 | 5.1.1 |
| org.apache.rocketmq:rocketmq-namesrv | maven | >= 5.0.0, < 5.1.1 | 5.1.1 |