CVE-2022-24969

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-24969
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24969.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-24969
Aliases
Published
2022-06-06T22:00:16Z
Modified
2026-05-28T04:07:33.077422026Z
Summary
bypass of CVE-2021-25640
Details

bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24969.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "Apache Dubbo 2.7.x"
                },
                {
                    "fixed": "2.7.15"
                },
                {
                    "introduced": "Apache Dubbo 2.6.x"
                },
                {
                    "last_affected": "2.6.12"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-918"
    ],
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/dubbo

Affected ranges

Type
GIT
Repo
https://github.com/apache/dubbo
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0aee8101665262c64122e5fa2c683ef834faff10
Introduced
614bcebc01336ee5047a98f96b28915680c0399c
Fixed
767620aeddfc84d2299e8ab6f754e56a5ce5a265
Database specific 
{
    "cpe": "cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.6.12"
        },
        {
            "introduced": "2.7.0"
        },
        {
            "fixed": "2.7.15"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

dubbo-2.*
dubbo-2.3.1
dubbo-2.3.2
dubbo-2.4.0
dubbo-2.4.1
dubbo-2.4.3
dubbo-2.5.4
dubbo-2.5.6
dubbo-2.5.7
dubbo-2.5.8
dubbo-2.6.0
dubbo-2.6.1
dubbo-2.6.10
dubbo-2.6.11
dubbo-2.6.6
dubbo-2.6.8
dubbo-2.6.9
dubbo-2.7.11
dubbo-2.7.13

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24969.json"