GHSA-whww-v56c-cgv2

ghsaUSosv

Deserialization of Untrusted Data in Apache Dubbo

view advisory published 2022-02-10Licence: CC-BY-4.0

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-1948US	critical9.8	16.4% (97th)	Exploit	2020-07-14
This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malici…

references

External citations — patches, advisories, analysis.

https://lists.apache.org/thread.html/rbaa41711b3e7a8cd20e9013737423ddd079ddc12f90180f86e76523c%40%3Csecurity.dubbo.apache.org%3EWEB
https://nsfocusglobal.com/apache-dubbo-remote-code-execution-vulnerability-cve-2020-1948-threat-alertWEB
https://nvd.nist.gov/vuln/detail/CVE-2020-1948ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan