GitHub Advisoryadvisory · Maven

GHSA-gw4j-4229-q4px Server-Side Request Forgery in Apache Dubbo

MEDIUM Published 2022-03-18 Modified 2022-03-18 Official page ↗
Aliases
CVE-2021-25640
Ecosystem
Maven
Packages
org.apache.dubbo:dubbo, com.alibaba:dubbo
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601, CWE-918
Reviewed
2021-06-02

Affected packages

• Maven org.apache.dubbo:dubbo: >= 2.5.0, < 2.7.10 → fixed in 2.7.10 • Maven com.alibaba:dubbo: >= 2.5.0, < 2.6.9 → fixed in 2.6.9

Description

In Apache Dubbo prior to 2.6.9 and 2.7.10, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.

Related

Alias · CVE (1)

  • CVE-2021-25640 In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open… vulnerability

Weakness · CWE (2)

  • CWE-601 URL Redirection to Untrusted Site weakness
  • CWE-918 Server-Side Request Forgery weakness

References