CVE-2019-17572

5.3MEDIUM

Key Information:

Vendor
Apache
Status
Apache RocketMQ
Vendor
CVE Published:
14 May 2020

Summary

In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.

Affected Version(s)

Apache RocketMQ Apache RocketMQ 4.2.0 to 4.6.0

References

https://lists.apache.org/thread.html/fdea1c5407da47a17d55...
x_refsource_MISC
https://seclists.org/oss-sec/2020/q2/112
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.