{
  "crds_version": "0.1",
  "kind": "base",
  "id": "crds:cve-2023-33246",
  "revision": 1,
  "title": "Apache RocketMQ — configuration updates without permission checks",
  "summary": "Several RocketMQ components sit exposed with no permission check in front of them, so an attacker uses the configuration update function to run commands as the account the service runs under. Versions 5.1.0 and below are affected.",
  "source_type": "cve",
  "severity": "critical",
  "cvss": {
    "score": 9.8,
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "version": "3.1"
  },
  "epss": 0.96568,
  "exploitation": {
    "known_exploited": true,
    "exploit_available": true,
    "attack_complexity": "low",
    "kev_added": "2023-09-06",
    "prerequisites": "Network access to an exposed name server, broker or controller."
  },
  "remediation": {
    "patch_available": true,
    "fixed_in": [
      "Apache RocketMQ >= 5.1.1",
      "Apache RocketMQ >= 4.9.6"
    ]
  },
  "mitre_attack": [
    "T1190"
  ],
  "kill_chain": "initial_access",
  "recommended_action": "Upgrade RocketMQ to 5.1.1 or 4.9.6, and take the name server, broker and controller ports off the public internet — the exposure is half of this flaw.",
  "confidence": "high",
  "provenance": [
    {
      "fields": [
        "cvss",
        "exploitation.attack_complexity",
        "exploitation.exploit_available",
        "references",
        "published_at"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2023-33246",
      "retrieved_at": "2026-09-24T12:52:19.575Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "exploitation.known_exploited",
        "exploitation.kev_added"
      ],
      "source": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "retrieved_at": "2026-09-24T12:52:19.575Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "epss"
      ],
      "source": "https://api.first.org/data/v1/epss?cve=CVE-2023-33246",
      "retrieved_at": "2026-09-24T12:52:19.575Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "title",
        "summary",
        "severity",
        "remediation",
        "mitre_attack",
        "kill_chain",
        "recommended_action",
        "confidence",
        "tags",
        "exploitation.prerequisites"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2023-33246",
      "retrieved_at": "2026-09-24T12:52:19.575Z",
      "confidence": "high",
      "extractor": "claude-code"
    }
  ],
  "references": [
    {
      "type": "cve",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33246",
      "label": "NVD record"
    },
    {
      "type": "cisa",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "label": "CISA Known Exploited Vulnerabilities catalog"
    },
    {
      "type": "vendor_advisory",
      "url": "https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp"
    },
    {
      "type": "exploit",
      "url": "http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html"
    },
    {
      "type": "exploit",
      "url": "https://www.vicarius.io/vsociety/posts/rocketmq-rce-cve-2023-33246-33247"
    }
  ],
  "published_at": "2023-05-24T15:15:09.553Z",
  "issued_at": "2026-09-24T12:52:19.575Z",
  "tags": [
    "apache",
    "rocketmq",
    "messaging",
    "command-execution",
    "kev"
  ]
}