GitHub Advisoryadvisory · Maven

GHSA-whww-v56c-cgv2 Deserialization of Untrusted Data in Apache Dubbo

CRITICAL Published 2022-02-10 Modified 2021-05-10 Official page ↗
Aliases
CVE-2020-1948
Ecosystem
Maven
Packages
org.apache.dubbo:dubbo, org.apache.dubbo:dubbo-common
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2021-05-10

Affected packages

• Maven org.apache.dubbo:dubbo: < 2.7.7 → fixed in 2.7.7 • Maven org.apache.dubbo:dubbo-common: < 2.7.7 → fixed in 2.7.7

Description

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.

Related

Alias · CVE (1)

  • CVE-2020-1948 This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References