Apache Software Foundation Apache Dubbo
16 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2023-46279 | 3.1.5 | Apache Dubbo: Bypass deny serialize list check in Apache Dubbo | CRITICAL 9.8 | 1.7 % | ||
| CVE-2023-29234 | 3.1.0 – 3.1.10 ; 3.2.0 – 3.2.4 | Bypass serialize checks in Apache Dubbo | CRITICAL 9.8 | 7.4 % | ||
| CVE-2023-23638 | Apache Dubbo 2.7.x – 2.7.21 ; Apache Dubbo 3.0.x – 3.0.13 ; Apache Dubbo 3.1.x – 3.1.5 | Apache Dubbo Deserialization Vulnerability Gadgets Bypass | CRITICAL 9.8 | 4.8 % | ||
| CVE-2022-39198 | Apache Dubbo 2.7.x – 2.7.17 ; Apache Dubbo 3.0.x – 3.0.11 ; Apache Dubbo 3.1.x – 3.1.0 | Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass | CRITICAL 9.8 | 3.3 % | ||
| CVE-2022-24969 | Apache Dubbo 2.7.x – < 2.7.15 ; Apache Dubbo 2.6.x – 2.6.12 | bypass of CVE-2021-25640 | MEDIUM 6.1 | 1.9 % | ||
| CVE-2021-43297 | Apache Dubbo 2.6.x – < 2.6.12 ; Apache Dubbo 2.7.x – < 2.7.15 ; Apache Dubbo 3.0.x – < 3.0.5 | Dubbo Hessian cause RCE when parse error | CRITICAL 9.8 | 17 % | ||
| CVE-2021-37579 | Apache Dubbo 2.7.x – 2.7.12 ; Apache Dubbo 3.0.x – 3.0.1 | Bypass deserialization checks in Apache Dubbo | CRITICAL 9.8 | 6.6 % | ||
| CVE-2021-36161 | Apache Dubbo 2.7.x – 2.7.12 | Unprotected input value toString cause RCE | CRITICAL 9.8 | 2.5 % | ||
| CVE-2021-36163 | Apache Dubbo 2.7.x – 2.7.12 ; Apache Dubbo 2.6.x – 2.6.10 | Unsafe deserialization in providers using the Hessian protocol | CRITICAL 9.8 | 3.3 % | ||
| CVE-2021-36162 | Apache Dubbo 2.7.x – 2.7.12 ; Apache Dubbo 3.0.x – 3.0.1 | Unprotected yaml deserialization cause RCE | HIGH 8.8 | 2.3 % | ||
| CVE-2021-30180 | Apache Dubbo 2.7.x – < 2.7.9 | Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling) | CRITICAL 9.8 | 60 % | ||
| CVE-2021-30179 | Apache Dubbo 2.7.x – < 2.7.9 ; Apache Dubbo 2.6.x – < 2.6.9 | Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter | CRITICAL 9.8 | 4.1 % | ||
| CVE-2021-25640 | Apache Dubbo 2.7.x – < 2.7.9 ; Apache Dubbo 2.6.x – < 2.6.9 | Open Redirect or SSRF vulnerability usage of parseURL | MEDIUM 6.1 | 2.1 % | ||
| CVE-2021-30181 | Apache Dubbo 2.7.x – < 2.7.9 ; Apache Dubbo 2.6.x – < 2.6.9 | Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection) | CRITICAL 9.8 | 61 % | ||
| CVE-2021-25641 | Apache Dubbo 2.7.x – < 2.7.8 ; Apache Dubbo 2.6.x – < 2.6.9 | Dubbo Zookeeper does not check serialization id | CRITICAL 9.8 | 21 % | ||
| CVE-2020-11995 | Apache Dubbo – < 2.6.9 | Apache Dubbo default deserialization protocol Hessian2 cause CRE | CRITICAL 9.8 | 5.9 % |