Lucene search

ApacheCVE-2021-36163

HistorySep 07, 2021 - 10:15 a.m.

CVE-2021-36163

2021-09-0710:15:07

CWE-502

apache

web.nvd.nist.gov

apache dubbo

hessian protocol

cve-2021-36163

vulnerability

unauthenticated attack

security

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.006

Percentile

78.3%

JSON

In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1

Affected configurations

Nvd

Vulners

Node

apachedubboRange2.7.0–2.7.12

apachedubboRange3.0.0–3.0.1

VendorProductVersionCPE
apachedubbo*cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	dubbo	*	cpe:2.3:a:apache:dubbo::::::::

CNA Affected

[
  {
    "product": "Apache Dubbo",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.7.12",
        "status": "affected",
        "version": "Apache Dubbo 2.7.x",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "2.6.10",
        "status": "affected",
        "version": "Apache Dubbo 2.6.x",
        "versionType": "custom"
      }
    ]
  }
]

References

lists.apache.org/thread.html/r8d0adc057bb15a37199502cc366f4b1164c9c536ce28e4defdb428c0%40%3Cdev.dubbo.apache.org%3E

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.006

Percentile

78.3%

JSON

Related for CVE-2021-36163