GHSA-whww-v56c-cgv2

Source

https://github.com/advisories/GHSA-whww-v56c-cgv2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-whww-v56c-cgv2/GHSA-whww-v56c-cgv2.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-whww-v56c-cgv2

Aliases

CVE-2020-1948

Published

2022-02-10T22:39:17Z

Modified

2024-02-17T05:36:24.040858Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Deserialization of Untrusted Data in Apache Dubbo

Details

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.

Database specific

{
    "nvd_published_at": "2020-07-14T14:15:00Z",
    "cwe_ids": [
        "CWE-502"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-10T21:50:14Z"
}

References

Affected packages

Maven / org.apache.dubbo:dubbo

Package

Name: org.apache.dubbo:dubbo; View open source insights on deps.dev
Purl: pkg:maven/org.apache.dubbo/dubbo

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.7.7

Affected versions

2.*

2.7.0

2.7.1

2.7.2

2.7.3

2.7.4

2.7.4.1

2.7.5

2.7.6

Maven / org.apache.dubbo:dubbo-common