Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

19 records

Vendor: Apache Component: Dubbo Clear all filters
TI-2023-13646 CVE-2023-29234 · GHSA-6x49-w35h-wqrj

Bypass serialize checks in Apache Dubbo

Priority MEDIUM 52

A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.07401 Published 2023-12-15 Fixed in 3.1.11, 3.2.5 CWE-502
TI-2023-09466 CVE-2023-23638 · GHSA-933g-v89r-x8pf

Apache Dubbo Deserialization Vulnerability Gadgets Bypass

Priority MEDIUM 50

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04887 Published 2023-03-08 Fixed in 2.7.22, 3.0.13 +1 CWE-502
TI-2021-12489 CVE-2021-32824 · GHSA-fprr-rrm8-4534

Regular expression Denial of Service in MooTools

Priority HIGH 82

Apache Dubbo is a java based, open source RPC framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03401 Published 2023-01-03 Fixed in 2.6.10, 2.7.10 CWE-502
TI-2022-18578 CVE-2022-39198 · GHSA-5qwq-g2hx-r6f7

Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass

Priority MEDIUM 55

A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03308 Published 2022-10-18 Fixed in 3.2.13, 2.7.18 +2 CWE-502
TI-2022-08764 CVE-2022-24969 · GHSA-gm48-83x4-84jg

bypass of CVE-2021-25640

Priority LOW 31

bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01865 Published 2022-06-06 Fixed in 2.7.15, 2.6.12 CWE-918
TI-2021-19290 CVE-2021-43297 · GHSA-vp5x-3v8r-qprw

Dubbo Hessian cause RCE when parse error

Priority MEDIUM 59

A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.17431 Published 2022-01-10 Fixed in 2.6.12, 2.7.15 +1 CWE-502
TI-2021-15466 CVE-2021-37579 · GHSA-q897-9jxf-jg9r

Bypass deserialization checks in Apache Dubbo

Priority MEDIUM 51

The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06561 Published 2021-09-09 Fixed in 2.7.13, 3.0.2 CWE-502
TI-2021-14580 CVE-2021-36161 · GHSA-qvm7-23cj-437v

Unprotected input value toString cause RCE

Priority MEDIUM 47

Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02467 Published 2021-09-09 Fixed in 2.7.13 CWE-134
TI-2021-14581 CVE-2021-36162 · GHSA-r577-4hq7-73qh

Unprotected yaml deserialization cause RCE

Priority MEDIUM 42

Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02261 Published 2021-09-07 Fixed in 2.7.13, 3.0.2 CWE-77
TI-2021-07773 CVE-2021-25640 · GHSA-gw4j-4229-q4px

Open Redirect or SSRF vulnerability usage of parseURL

Priority LOW 31

In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02073 Published 2021-05-31 Fixed in 2.7.9, 2.6.9 +1 CWE-918
TI-2021-07774 CVE-2021-25641 · GHSA-v2rg-8cwr-75g8

Dubbo Zookeeper does not check serialization id

Priority MEDIUM 61

Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.21221 Published 2021-05-29 Fixed in 2.7.8, 2.6.9 CWE-502
TI-2020-09654 CVE-2020-11995 · GHSA-74mg-6xqx-2vrq

Apache Dubbo default deserialization protocol Hessian2 cause CRE

Priority MEDIUM 51

A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05926 Published 2021-01-11 Fixed in 2.6.9, 2.7.8 CWE-502
TI-2020-01872 CVE-2020-1948 · GHSA-whww-v56c-cgv2

Deserialization of untrusted data in Apache Dubbo

Priority MEDIUM 59

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.16441 Published 2020-07-14 Fixed in 2.7.7 CWE-502
TI-2019-13107 CVE-2019-17564 · GHSA-69wp-3pm3-hxgg

Deserialization of untrusted data in Apache Dubbo

Priority HIGH 68

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.36513 Published 2020-04-01 Fixed in 2.7.5 CWE-502