GitHub Advisoryadvisory · Maven

GHSA-gm48-83x4-84jg Server-side request forgery in Apache Dubbo

MEDIUM Published 2022-06-10 Modified 2022-06-17 Official page ↗
Aliases
CVE-2022-24969
Ecosystem
Maven
Packages
org.apache.dubbo:dubbo, com.alibaba:dubbo
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601, CWE-918
Reviewed
2022-06-10

Affected packages

• Maven org.apache.dubbo:dubbo: >= 2.5.0, < 2.7.15 → fixed in 2.7.15 • Maven com.alibaba:dubbo: >= 2.5.0, < 2.6.12 → fixed in 2.6.12

Description

bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.

Related

Alias · CVE (1)

  • CVE-2022-24969 bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host… vulnerability

Weakness · CWE (2)

  • CWE-601 URL Redirection to Untrusted Site weakness
  • CWE-918 Server-Side Request Forgery weakness

References