CVE-2021-37579
published 2021-09-09CVE-2021-37579: The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But…
PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
6.53%
92.9th percentile
The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | dubbo | >= 2.7.0 < 2.7.13 | 2.7.13 |
| apache | dubbo | >= 3.0.0 < 3.0.2 | 3.0.2 |
| apache_software_foundation | apache_dubbo | Apache Dubbo 2.7.x – 2.7.12 | — |
| apache_software_foundation | apache_dubbo | Apache Dubbo 3.0.x – 3.0.1 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Security check skip in Apache Dubbo
osv·2021-09-10
CVE-2021-37579 [CRITICAL] Security check skip in Apache Dubbo
Security check skip in Apache Dubbo
The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found.
GHSA
Security check skip in Apache Dubbo
ghsa·2021-09-10
CVE-2021-37579 [CRITICAL] CWE-502 Security check skip in Apache Dubbo
Security check skip in Apache Dubbo
The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-09-09
Published