CVE-2019-17572
Quick assessment
Affected
n/a Apache RocketMQ
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache RocketMQ是美国阿帕奇软件（Apache Software）基金会的一款轻量级的数据处理平台和消息传递引擎。 Apache RocketMQ 4.2.0版本至4.6.0版本中存在路径遍历漏洞。攻击者可利用该漏洞在父目录中创建主体文件夹。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2019-17572
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Apache RocketMQ 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache RocketMQ是美国阿帕奇软件（Apache Software）基金会的一款轻量级的数据处理平台和消息传递引擎。 Apache RocketMQ 4.2.0版本至4.6.0版本中存在路径遍历漏洞。攻击者可利用该漏洞在父目录中创建主体文件夹。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | Apache RocketMQ | Apache RocketMQ 4.2.0 to 4.6.0 | - |
|
II. Public POCs for CVE-2019-17572
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | None | https://github.com/shoucheng3/apache__rocketmq_CVE-2019-17572_4-6-0 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-17572
请登录查看更多情报信息。
Mailing List Discussions for CVE-2019-17572 (2)
-
https://seclists.org/oss-sec/2020/q2/112 x_refsource_MISC
Same Patch Batch · n/a · 2020-05-14 · 47 CVEs total
| CVE-2020-0091 | Android mnld组件信息泄露漏洞 | |
| CVE-2020-0064 | Android Omacp组件安全漏洞 | |
| CVE-2020-0220 | Android Audio driver 缓冲区错误漏洞 | |
| CVE-2020-12068 | 3S-Smart Software Solutions CODESYS Development System 安全漏洞 | |
| CVE-2020-12046 | Opto 22 SoftPAC Project 数据伪造问题漏洞 | |
| CVE-2020-10612 | Opto 22 SoftPAC Project 访问控制错误漏洞 | |
| CVE-2020-10616 | Opto 22 SoftPAC Project 代码问题漏洞 | |
| CVE-2020-10620 | Opto 22 SoftPAC Project 授权问题漏洞 | |
| CVE-2020-12042 | Opto 22 SoftPAC Project 数据伪造问题漏洞 | |
| CVE-2020-0090 | Android Email组件安全漏洞 | |
| CVE-2020-0065 | Android Suite Daemon 安全漏洞 | |
| CVE-2020-0093 | Android 缓冲区错误漏洞 | |
| CVE-2020-0106 | Android System 信息泄露漏洞 | |
| CVE-2020-0094 | Android Media Framework 缓冲区错误漏洞 | |
| CVE-2020-0110 | Android Kernel Scheduler 缓冲区错误漏洞 | |
| CVE-2020-0103 | Android System 缓冲区错误漏洞 | |
| CVE-2020-0109 | Android System 安全漏洞 | |
| CVE-2020-0097 | Android Framework 安全漏洞 | |
| CVE-2020-0096 | Android Framework 安全漏洞 | |
| CVE-2020-0092 | Android System 信息泄露漏洞 |
Showing top 20 of 47 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2019-17572
No comments yet