Read the docs
TI-2022-08764 Aliases CVE-2022-24969GHSA-gm48-83x4-84jg

bypass of CVE-2021-25640

Priority LOW 31CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.

Why it matters now

EPSS 0.01865 79th percentileScored 2026-11-07
Fix Fixed Apache Dubbo (Apache Software Foundation): 2.7.15org.apache.dubbo:dubbo (Maven): 2.7.15+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache DubboApache Dubbo 2.7.x to before 2.7.15; Apache Dubbo 2.6.x – 2.6.122.7.15Patch availableCNA
—org.apache.dubbo:dubbo (Maven)2.5.0 to before 2.7.152.7.15Patch availableGHSA-gm48-83x4-84jg
—com.alibaba:dubbo (Maven)2.5.0 to before 2.6.122.6.12Patch availableGHSA-gm48-83x4-84jg
  • Apache Dubbo VendorApache Affected Apache Dubbo 2.7.x to before 2.7.15; Apache Dubbo 2.6.x – 2.6.12 Fixed in 2.7.15 Patch available CNA
  • org.apache.dubbo:dubbo (Maven) Vendor— Affected 2.5.0 to before 2.7.15 Fixed in 2.7.15 Patch available GHSA-gm48-83x4-84jg
  • com.alibaba:dubbo (Maven) Vendor— Affected 2.5.0 to before 2.6.12 Fixed in 2.6.12 Patch available GHSA-gm48-83x4-84jg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*before 2.6.12; 2.7.0 to before 2.7.15VulnerableApache
  • cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:* Versions before 2.6.12; 2.7.0 to before 2.7.15 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Dubbo (Apache Software Foundation) Fixed in 2.7.15
  • Fix · GHSA-gm48-83x4-84jg org.apache.dubbo:dubbo (Maven) Fixed in 2.7.15 Advisory →
  • Fix · GHSA-gm48-83x4-84jg com.alibaba:dubbo (Maven) Fixed in 2.6.12 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24969
  2. 2026-10-03 Alias added: GHSA-gm48-83x4-84jg

References

Advisory 3

Other 1

  • TI-2021-12489 Regular expression Denial of Service in MooTools CVSS 3.1CRITICAL 9.8
  • TI-2021-10721 Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection) CVSS 3.1CRITICAL 9.8
  • TI-2021-10720 Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling) CVSS 3.1CRITICAL 9.8
  • TI-2019-13107 Deserialization of untrusted data in Apache Dubbo CVSS 3.1CRITICAL 9.8
  • TI-2021-07774 Dubbo Zookeeper does not check serialization id CVSS 3.1CRITICAL 9.8
  • TI-2021-19290 Dubbo Hessian cause RCE when parse error CVSS 3.1CRITICAL 9.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences