Apache Dubbo vulnerabilities

1 known vulnerability affecting apache/apache_dubbo.

Total CVEs

1

CISA KEV

0

Public exploits

1

Exploited in wild

1

Severity breakdown

CRITICAL1

Vulnerabilities

Page 1 of 1

CVE-2019-17564CRITICALCVSS 9.8ExploitedPoCv2.7.0 to 2.7.4v2.6.0 to 2.6.7+1 more2020-04-01

CVE-2019-17564 [CRITICAL] CWE-502 CVE-2019-17564: Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacke Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.