Apache Software Foundation Vulnerabilities and Affected Products
Vulnerabilities associated with Apache Dubbo.
Products
Clear product- Apache Airflow148 vulnerabilities
- Apache HTTP Server119 vulnerabilities
- Apache Tomcat111 vulnerabilities
- Apache Traffic Server95 vulnerabilities
- Apache Superset65 vulnerabilities
- Apache OFBiz51 vulnerabilities
- Apache CXF45 vulnerabilities
- Apache NiFi43 vulnerabilities
- Apache Camel42 vulnerabilities
- Apache ActiveMQ34 vulnerabilities
- Apache CloudStack31 vulnerabilities
- Apache DolphinScheduler31 vulnerabilities
- Apache InLong31 vulnerabilities
- Apache Thrift28 vulnerabilities
- Apache OpenOffice26 vulnerabilities
- Apache IoTDB25 vulnerabilities
- Apache Zeppelin25 vulnerabilities
- Apache Answer24 vulnerabilities
- Apache Solr24 vulnerabilities
- Apache Struts24 vulnerabilities
- Apache APISIX23 vulnerabilities
- Apache OpenMeetings23 vulnerabilities
- Apache Ranger23 vulnerabilities
- Apache JSPWiki22 vulnerabilities
- Apache Fineract20 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-46279CRITICAL | Apache Dubbo: Bypass deny serialize list check in Apache DubboDeserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrade to the latest version, which fixes the issue. CWE-502Dec 15, 2023 | CVSS9.8v3.1 | EPSS1.67% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-29234CRITICAL | Bypass serialize checks in Apache DubboA deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. Users are recommended to upgrade to the latest version, which fixes the issue. CWE-502Dec 15, 2023 | CVSS9.8v3.1 | EPSS7.4% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-23638MEDIUM | Apache Dubbo Deserialization Vulnerability Gadgets BypassA deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions. CWE-502Mar 8, 2023 | CVSS5.0v3.1 | EPSS4.85% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-39198CRITICAL | Apache Dubbo Hession Deserialization Vulnerability Gadgets BypassA deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions. CWE-502Oct 18, 2022 | CVSS9.8v3.1 | EPSS2.43% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-24969MEDIUM | bypass of CVE-2021-25640bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability. | CVSS6.1v3.1 | EPSS1.74% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-43297CRITICAL | Dubbo Hessian cause RCE when parse errorA deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.… CWE-502Jan 10, 2022 | CVSS9.8v3.1 | EPSS17% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-37579CRITICAL | Bypass deserialization checks in Apache DubboThe Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found. CWE-502Sep 9, 2021 | CVSS9.8v3.1 | EPSS6.56% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-36161CRITICAL | Unprotected input value toString cause RCESome component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method. In the latest version, we fix the toString call in timeout, cache and some other places. Fixed in Apache Dubbo 2.7.13 CWE-134Sep 9, 2021 | CVSS9.8v3.1 | EPSS2.47% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-36163CRITICAL | Unsafe deserialization in providers using the Hessian protocolIn Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair.… CWE-502Sep 7, 2021 | CVSS9.8v3.1 | EPSS3.25% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-36162HIGH | Unprotected yaml deserialization cause RCEApache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). These rules are loaded into the configuration center (eg: Zookeeper, Nacos, ...) and retrieved by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers will use SnakeYAML library to load the rules which by default will enable calling arbitrary constructors. An attacker with access to the configuration center he will … CWE-77Sep 7, 2021 | CVSS8.8v3.1 | EPSS2.26% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-30180CRITICAL | Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors. | CVSS9.8v3.1 | EPSS60.4% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-30179CRITICAL | Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filterApache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API to make the final call. The signature for the $invoke or $invokeAsync methods is Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the name of the method to invoke, th… CWE-502May 31, 2021 | CVSS9.8v3.1 | EPSS4.08% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-25640MEDIUM | Open Redirect or SSRF vulnerability usage of parseURLIn Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability. | CVSS6.1v3.1 | EPSS2.07% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-30181CRITICAL | Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code. CWE-94May 29, 2021 | CVSS9.8v3.1 | EPSS60.6% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-25641CRITICAL | Dubbo Zookeeper does not check serialization idEach Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can … CWE-502May 29, 2021 | CVSS9.8v3.1 | EPSS21.1% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-11995CRITICAL | Apache Dubbo default deserialization protocol Hessian2 cause CREA deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HasMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.… CWE-502Jan 11, 2021 | CVSS9.8v3.1 | EPSS5.68% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |