CVE-2023-37582

The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as. It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.

• CWE-94

• http://www.openwall.com/lists/oss-security/2023/07/12/1Mailing List, Patch, Third Party Advisory
• https://lists.apache.org/thread/m614czxtpvlztd7mfgcs2xcsg36rdbncMailing List, Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2023/07/12/1Mailing List, Patch, Third Party Advisory
• https://lists.apache.org/thread/m614czxtpvlztd7mfgcs2xcsg36rdbncMailing List, Patch, Vendor Advisory

Published

Jul 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-37577Multiple use-after-free vulnerabilities exist in the VCD get…7.8
• CVE-2023-37578Multiple use-after-free vulnerabilities exist in the VCD get…7.8
• CVE-2023-37579Incorrect Authorization vulnerability in Apache Software Fou…6.5
• CVE-2023-3758A race condition flaw was found in sssd where the GPO policy…7.1
• CVE-2023-37580Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows X…6.1
• CVE-2023-37581Insufficient input validation and sanitation in Weblog Categ…5.4
• CVE-2023-3759A vulnerability, which was classified as critical, was found…9.8
• CVE-2023-37596Cross Site Request Forgery (CSRF) vulnerability in issabel-p…8.1
• CVE-2023-37597Cross Site Request Forgery (CSRF) vulnerability in issabel-p…8.1
• CVE-2023-37598A Cross Site Request Forgery (CSRF) vulnerability in issabel…4.5
• CVE-2023-37599An issue in issabel-pbx v.4.0.0-6 allows a remote attacker t…7.5
• CVE-2023-3760A vulnerability has been found in Intergard SGS 8.7.0 and cl…6.5