Apache Dubbo 代码问题漏洞

Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. The product provides interface-based remote calling , fault tolerance and load balancing and automatic service registration and discovery. A deserialization vulnerability...

Apache Dubbo 代码问题漏洞

Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. The product provides interface-based remote calling , fault tolerance and load balancing and automatic service registration and discovery. A security vulnerability exists in...

PT-2023-29942 · Apache · Apache Dubbo

Name of the Vulnerable Software and Affected Versions: Apache Dubbo version 3.1.5 Description: The issue is related to the deserialization of untrusted data in Apache Dubbo. Users are advised to upgrade to the latest version to fix the issue. Recommendations: For Apache Dubbo version 3.1.5, upgra...

The vulnerability of the Apache Dubbo RPC framework, related to deficiencies in the deserialization mechanism, allows attackers to execute arbitrary code.

The vulnerability of the Apache Dubbo RPC framework is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

A Deserialization Vulnerability Found in Apache Dubbo

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Apache has released a security notice for a deserialization vulnerability CVE-2023-23638 in Apache Dubbo that allows remote attackers to execute arbitrary code on the target system. To receive...

Exploit for Deserialization of Untrusted Data in Apache Dubbo

CVE-2023-23638 For educational purposes only. Provided by Zo...

Exploit for Deserialization of Untrusted Data in Apache Dubbo

CVE-2023-23638 For educational purposes only. Provided by Zo...

Apache Dubbo code issue vulnerability (CNVD-2023-23551)

Apache Dubbo is a lightweight Java-based RPC remote procedure call framework from the Apache Foundation in the United States. The product provides interface-based remote calling, fault tolerance and load balancing, and automatic service registration and discovery.A security vulnerability exists i...

Remote Code Execution (RCE)

org.apache.dubbo:dubbo-common is vulnerable to Remote Code Execution RCE. The vulnerability is due to a lack of class validation when deserializing untrusted user input which allows an attacker to upload and execute malicious code...

Apache Dubbo vulnerable to Deserialization of Untrusted Data

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions...

GHSA-933G-V89R-X8PF Apache Dubbo vulnerable to Deserialization of Untrusted Data

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions...

CVE-2023-23638

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions...

Deserialization of untrusted data

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions...

CVE-2023-23638 Apache Dubbo Deserialization Vulnerability Gadgets Bypass

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions...

CVE-2023-23638 Apache Dubbo Deserialization Vulnerability Gadgets Bypass

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions...

CVE-2023-23638 Apache Dubbo Deserialization Vulnerability Gadgets Bypass

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions...

CVE-2023-23638

Apache Dubbo CVE-2023-23638 describes a deserialization flaw during generic-invoke that enables remote code execution. Affected: Dubbo 2.7.x (≤2.7.21), 3.0.x (≤3.0.13), 3.1.x (≤3.1.5). Root cause: insecure deserialization in the generic invoke path. Impact: potential RCE with high impact to confi...

PT-2023-3056 · Apache · Apache Dubbo

Name of the Vulnerable Software and Affected Versions: Apache Dubbo versions 2.7.21 and prior versions Apache Dubbo versions 3.0.13 and prior versions Apache Dubbo versions 3.1.5 and prior versions Description: A deserialization vulnerability existed when dubbo generic invoke, which could lead to...

Apache Dubbo 代码问题漏洞

Apache Dubbo is a lightweight Java-based RPC remote procedure call framework from the Apache Foundation in the United States. The product provides interface-based remote calling, fault tolerance and load balancing, and automatic service registration and discovery.A security vulnerability exists i...

K25893729: Apache Dubbo vulnerability CVE-2021-25641

Security Advisory Description Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamb...