GitHub Advisoryadvisory · Maven

GHSA-7wfc-x4f7-gg2x Code injection in Apache Dubbo

CRITICAL Published 2022-03-18 Modified 2022-03-18 Official page ↗
Aliases
CVE-2021-30180
Ecosystem
Maven
Packages
org.apache.dubbo:dubbo
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-444, CWE-94
Reviewed
2021-06-02

Affected packages

• Maven org.apache.dubbo:dubbo: >= 2.7.0, < 2.7.10 → fixed in 2.7.10

Description

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.

Related

Alias · CVE (1)

  • CVE-2021-30180 Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. vulnerability

Weakness · CWE (2)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness
  • CWE-94 Improper Control of Generation of Code weakness

References