Directory Traversal Vulnerability in Apache RocketMQ by Apache

CVE-2019-17572

Summary

In Apache RocketMQ versions 4.2.0 through 4.6.0, a configuration issue with automatic topic creation can allow an attacker to send malicious topic names. This could lead to a directory traversal vulnerability, permitting the creation of folders outside the intended directory structure. Specifically, if the topic name is crafted to include relative path elements, it may allow for unauthorized directory access. Users are advised to upgrade to Apache RocketMQ 4.6.1 or later to secure their installations.

References