GHSA-gm48-83x4-84jg

ghsaUSosv

Server-side request forgery in Apache Dubbo

view advisory published 2022-06-10Licence: CC-BY-4.0

bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-24969US	medium6.1	1.86% (79th)	—	2022-06-09
bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SS…

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-gw4j-4229-q4pxADVISORY
https://lists.apache.org/thread/1xbckc3467wfk5r7n2o44r2brdsbwxgrWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-25640ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2022-24969ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan