238 matches found
CVE-2020-11995
A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored...
Deserialization of untrusted data
A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored...
CVE-2020-11995 Apache Dubbo default deserialization protocol Hessian2 cause CRE
A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored...
CVE-2020-11995
This CVE describes a deserialization vulnerability in Apache Dubbo up to version 2.7.5 (and earlier) where Hessian2 deserializing a HashMap can trigger code execution via certain class methods (notably EqualsBean in rome-1.7.0.jar). The issue arises from the default Hessian2 deserialization path ...
Apache Dubbo Code Issue Vulnerability
Apache Dubbo is the United States Apache Software Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. It provides interface-based remote calling, fault tolerance and load balancing, and automated service registration and discovery. A code issue vulnerability exists ...
Apache Dubbo Remote Code Execution (CVE-2020-1948)
A remote code execution vulnerability exists in Apache Dubbo. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Exploit for Deserialization of Untrusted Data in Apache Dubbo
Apache Dubbo Deserialization Vulnerability Research This repo...
Exploit for Deserialization of Untrusted Data in Apache Dubbo
cve-2020-1948-poc Apache Dubbo反序列化漏洞...
Apache Dubbo Provider Remote Code Execution Vulnerability
Apache Dubbo is a Java-based high-performance RPC framework . A remote code execution vulnerability exists in Apache Dubbo Provider. An attacker can send RPC requests with unauthenticated service names or method names in conjunction with additional malicious parameter loads. When the malicious...
CVE-2019-17564
Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4,...
CVE-2019-17564
Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4,...
CVE-2019-17564
CVE-2019-17564 is an unsafe deserialization vulnerability in Apache Dubbo when HTTP remoting is enabled. An attacker can send a POST with a Java object to fully compromise a Dubbo Provider instance. Affected versions include 2.7.0–2.7.4, 2.6.0–2.6.7, and all 2.5.x. The exploitation leads to remot...
Exploit for Deserialization of Untrusted Data in Apache Dubbo
CVE-2019-17564 FastJson + SpringFramework Gadget for Dubbo 2.7...
Unauthorized Access Vulnerability in Apache Dubbo
Apache Dubbo is Alibaba's open source service framework that allows applications to achieve high-performance RPC service output and input functions can be integrated with the Spring Framework . Apache Dubbo has an unauthorized access vulnerability that can be exploited by attackers to obtain...
Apache Dubbo Deserialization Vulnerability
Apache Dubbo is a Java-based high-performance RPC framework . Apache Dubbo has a deserialization vulnerability that can be exploited by an attacker to execute code...
PT-2020-9918 · Apache · Apache Dubbo
Name of the Vulnerable Software and Affected Versions: Apache Dubbo versions 2.5.x Apache Dubbo versions 2.6.0 through 2.6.7 Apache Dubbo versions 2.7.0 through 2.7.4 Description: Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a PO...