Remote Code Execution (RCE)

dubbo-cluster is vulnerable to remote code execution. The vulnerability exists in the doInvoke function of BroadcastClusterInvoker.java as it does not properly handle FastJson when invoking the invoke handler and later processes in PojoUtils.realize, allowing an attacker to instantiate arbitrary...

com.alibaba:dubbo-cluster (>=2.6.2 <=2.6.12), com.alibaba:dubbo-common (>=2.6.2 <=2.6.12) +73 more potentially affected by CVE-2022-39198 via com.alibaba:hessian-lite (>=2.6.2 <=3.2.12)

com.alibaba:hessian-lite MAVEN version =2.6.2, =2.6.2, =2.6.2, =2.6.2, =2.6.2, =2.6.2, =2.6.2, =2.6.2, =2.6.2, =2.6.2, =2.6.2, =2.6.2, =2.6.2, =2.6.2, =2.6.2, =2.6.2, =2.6.12 and more Source cves: CVE-2022-39198 Source advisory: OSV:GHSA-5QWQ-G2HX-R6F7...