CVE-2021-43297
published 2022-01-10CVE-2021-43297: A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users…
PriorityP266critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
15.31%
96.4th percentile
A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | dubbo | >= 2.6.0 < 2.6.12 | 2.6.12 |
| apache | dubbo | >= 2.7.0 < 2.7.15 | 2.7.15 |
| apache | dubbo | >= 3.0.0 < 3.0.5 | 3.0.5 |
| apache_software_foundation | apache_dubbo | >= Apache Dubbo 2.6.x < 2.6.12 | 2.6.12 |
| apache_software_foundation | apache_dubbo | >= Apache Dubbo 2.7.x < 2.7.15 | 2.7.15 |
| apache_software_foundation | apache_dubbo | >= Apache Dubbo 3.0.x < 3.0.5 | 3.0.5 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Deserialization of Untrusted Data in Dubbo
osv·2022-01-12
CVE-2021-43297 [CRITICAL] Deserialization of Untrusted Data in Dubbo
Deserialization of Untrusted Data in Dubbo
A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.
GHSA
Deserialization of Untrusted Data in Dubbo
ghsa·2022-01-12
CVE-2021-43297 [CRITICAL] CWE-502 Deserialization of Untrusted Data in Dubbo
Deserialization of Untrusted Data in Dubbo
A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-01-10
Published