CVE-2023-23638

CWE-502 — Deserialization of Untrusted Data5 documents4 sources

Severity

9.8CRITICAL

EPSS

68.3%

top 1.39%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Software Foundation Apache Dubbo Apache Dubbo

Timeline

PublishedMar 8

Latest updateApr 10

Description

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LExploitability: 1.6 | Impact: 3.4

Affected Packages3 packages

▶Mavenorg.apache.dubbo:dubbo3.0.0 — 3.0.13+2

▶NVDapache/dubbo2.7.0 — 2.7.21+2

▶CVEListV5apache_software_foundation/apache_dubboApache Dubbo 2.7.x — 2.7.21+2

🔴Vulnerability Details

OSV

squid vulnerabilities↗2024-04-10

▶

OSV

Apache Dubbo vulnerable to Deserialization of Untrusted Data↗2023-03-08

▶

CVEList

Apache Dubbo Deserialization Vulnerability Gadgets Bypass↗2023-03-08

▶

GHSA

Apache Dubbo vulnerable to Deserialization of Untrusted Data↗2023-03-08

▶