Apache Dubbo vulnerabilities

19 CVEs affecting Apache Dubbo, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-46279, published 2023-12-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-30181, published 2021-06-01. Critical severity, CVSS 9.8. EPSS: 60.9% chance of exploitation in the next 30 days. Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in…
CVE-2021-30180, published 2021-06-01. Critical severity, CVSS 9.8. EPSS: 60.3% chance of exploitation in the next 30 days. Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the…
CVE-2019-17564, published 2020-04-01. Critical severity, CVSS 9.8. EPSS: 36.5% chance of exploitation in the next 30 days. Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance…
CVE-2021-25641, published 2021-06-01. Critical severity, CVSS 9.8. EPSS: 21.2% chance of exploitation in the next 30 days. Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which…
CVE-2021-43297, published 2022-01-10. Critical severity, CVSS 9.8. EPSS: 16.5% chance of exploitation in the next 30 days. A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default…
CVE-2020-1948, published 2020-07-14. Critical severity, CVSS 9.8. EPSS: 16.4% chance of exploitation in the next 30 days. This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter…
CVE-2023-29234, published 2023-12-15. Critical severity, CVSS 9.8. EPSS: 7.4% chance of exploitation in the next 30 days. A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. Users are recommended to upgrade to the…
CVE-2021-37579, published 2021-09-09. Critical severity, CVSS 9.8. EPSS: 6.6% chance of exploitation in the next 30 days. The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can…
CVE-2020-11995, published 2021-01-11. Critical severity, CVSS 9.8. EPSS: 5.9% chance of exploitation in the next 30 days. A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default…
CVE-2023-23638, published 2023-03-08. Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days. A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache…

Latest

CVE-2023-46279, published 2023-12-15. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrade to the latest version, which fixes the issue.
CVE-2021-32824, published 2023-01-03. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. Apache Dubbo is a java based, open source RPC framework. Versions prior to 2.6.10 and 2.7.10 are vulnerable to pre-auth remote code execution via arbitrary bean manipulation in the Telnet handler.…
CVE-2022-39198, published 2022-10-18. Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days. A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and…
CVE-2022-24969, published 2022-06-09. Medium severity, CVSS 6.1. EPSS: 1.8% chance of exploitation in the next 30 days. bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.
CVE-2021-36161, published 2021-09-09. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method. In the latest…
CVE-2021-36163, published 2021-09-07. Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days. In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New…