Apache Dubbo 代码问题漏洞

Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. The product provides interface-based remote calling , fault tolerance and load balancing and automatic service registration and discovery. A security vulnerability exists in...

Apache Dubbo 环境问题漏洞

Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. The product provides interface-based remote calling , fault tolerance and load balancing and automatic service registration and discovery. A security vulnerability previousl...

Apache Dubbo Deserialization Vulnerability (CNVD-2021-39669)

Apache Dubbo is the Apache Foundation's Java-based high-performance open source RPC framework. A deserialization vulnerability exists in Apache Dubbo versions prior to 2.7.8 and 2.6.9. An attacker can use this vulnerability to further exploit by tampering with byte leading flags and specifying a...

Apache Dubbo代码问题漏洞

Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. The product provides interface-based remote calling , fault tolerance and load balancing and automatic service registration and discovery. A deserialization vulnerability...

Apache Dubbo 安全漏洞

Apache Dubbo is the Apache Foundation of a Java-based high-performance open source RPC framework . An arbitrary command execution vulnerability exists in several versions of Dubbo. An attacker can exploit this vulnerability by injecting malicious code into the routing scripts , the default...

CVE-2021-30180 Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary...

CVE-2021-30180

CVE-2021-30180 — Apache Dubbo : Affects Dubbo versions prior to 2.7.9. The vulnerability arises when parsing YAML tag routing rules, which may allow a client to trigger calling arbitrary constructors on the server. This is the underlying root cause described in the initial details. Potential impa...

CVE-2021-30179 Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter

Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API...

CVE-2021-30179

Apache Dubbo CVE-2021-30179 affects versions prior to 2.6.9 and 2.7.9. The vulnerability arises because GenericFilter allows generic calls to arbitrary methods on provider interfaces, using Java Reflection. The invocation of $invoke/$invokeAsync uses a first argument method name, parameter types,...

CVE-2021-25640 Open Redirect or SSRF vulnerability usage of parseURL

In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability...

CVE-2021-25640

CVE-2021-25640 affects Apache Dubbo prior to versions 2.6.12 and 2.7.15, where the parseURL method can bypass white-host checks, enabling open redirect or SSRF. Impacted components and exact root cause are described across multiple sources; exploitation status is not detailed here. Remediation is...

PT-2021-16719 · Apache · Apache Dubbo

Name of the Vulnerable Software and Affected Versions: Apache Dubbo versions prior to 2.6.9 and 2.7.9 Apache Dubbo versions prior to 2.6.9 and 2.7.10 Apache Dubbo versions prior to 2.6.12 and 2.7.15 However, to consolidate the ranges of affected versions into the most concise form and avoid...

CVE-2021-30181

Apache Dubbo vulnerability CVE-2021-30181 involves Script routing where ScriptEngine parsing routing rules may allow executing arbitrary code. Affected versions include Dubbo prior to 2.6.9 and 2.7.9/2.7.10 (as described in multiple sources). The issue stems from the default ScriptEngine configur...

CVE-2021-30181 Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)

Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run...

CVE-2021-25641 Dubbo Zookeeper does not check serialization id

Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following t...

CVE-2021-25641

CVE-2021-25641 affects Apache Dubbo servers prior to 2.7.8 and 2.6.9. The vulnerability arises when a provider’s byte preamble flags are tampered with, allowing an attacker to override the server’s chosen serialization protocol and trigger a weak deserializer (e.g., Kryo or FST) in scope. This en...

The vulnerability of the Apache Dubbo RPC framework lies in errors during the validation of input data according to the Dubbo protocol, allowing attackers to execute arbitrary code.

The vulnerability of the Apache Dubbo RPC framework is related to errors in checking input data according to the Dubbo protocol. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

(0Day) Apache Dubbo readUTF Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apache Dubbo. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the Dubbo protocol. Crafted data in a Dubbo protocol message can trigger th...

(0Day) Apache Dubbo decodeBody Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apache Dubbo. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the Dubbo protocol. Crafted data in a Dubbo protocol message can trigger th...

Remote Code Execution (RCE)

dubbo is vulnerable to remote code execution. The vulnerability exists because some functions in the classes stored in HasMap will be executed after a series of program calls via a crafted malicious request...