1. Home
  2. CVE Database
  3. CVE-2023-26512
CRITICAL · 9.8

CVE-2023-26512

CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g. platforms allows attackers to send control...

Vulnerability Description

CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via rabbitmq messages. Users can use the code under the master branch in project repo to fix this issue, we will release the new version as soon as possible.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
ApacheEventmesh-Connector-Rabbitmq>= 1.7.0, <= 1.8.0
AppleMacos-
LinuxLinux Kernel-
MicrosoftWindows-

Related Weaknesses (CWE)

CWE-502

References

FAQ

What is CVE-2023-26512?

CVE-2023-26512 is a vulnerability with a CVSS score of 9.8 (CRITICAL). CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g. platforms allows attackers to send control...

How severe is CVE-2023-26512?

CVE-2023-26512 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2023-26512?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Eventmesh-Connector-Rabbitmq, Apple Macos, Linux Linux Kernel, Microsoft Windows.