CVE-2023-26512

CVE-2023-26512: Apache EventMesh RabbitMQ-Connector plugin allows RCE through deserialization of untrusted data

Vendor Apache Software Foundation
Product Apache EventMesh (incubating) RabbitMQ connector
Weakness CWE-502 · Unsafe deserialization
Published July 17, 2023
Last update October 2, 2024

CVSS base score

What the vulnerability does

Description

CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via rabbitmq messages. Users can use the code under the master branch in project repo to fix this issue, we will release the new version as soon as possible.

Key dates

Disclosure timeline

July 17, 2023 CVE published
October 2, 2024 Record updated