CVE-2019-17564

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2019-17564
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17564.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-17564
Aliases
Published
2020-04-01T22:15:15Z
Modified
2024-06-06T12:39:14.407906Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.

References

Affected packages

Git / github.com/apache/dubbo

Affected versions

dubbo-2.*

dubbo-2.5.10
dubbo-2.5.9
dubbo-2.6.0
dubbo-2.7.0