Maven Package Vulnerabilities

Open in search

Vulnerabilities associated with com.alibaba:dubbo.

Packages

Clear package

Showing 5 vulnerabilities on this page for com.alibaba:dubbo

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

bypass of CVE-2021-25640

bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.

CWE-601CWE-918Jun 6, 2022
CVSS6.1v3.1EPSS1.74%PoCs0SignalsSTIX

Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter

Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API to make the final call. The signature for the $invoke or $invokeAsync methods is Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the name of the method to invoke, th…

CWE-502May 31, 2021
CVSS9.8v3.1EPSS4.08%PoCs1SignalsSTIX

Open Redirect or SSRF vulnerability usage of parseURL

In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.

CWE-601CWE-918May 31, 2021
CVSS6.1v3.1EPSS2.07%PoCs0SignalsSTIX

Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)

Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.

CWE-94May 29, 2021
CVSS9.8v3.1EPSS60.6%PoCs1SignalsSTIX

Dubbo Zookeeper does not check serialization id

Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can …

CWE-502May 29, 2021
CVSS9.8v3.1EPSS21.1%PoCs2SignalsSTIX