Identifier

CVE-2020-1948

Package Slug

maven/org.apache.dubbo/dubbo

Vulnerability

Deserialization of Untrusted Data

Description

An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code.

Affected Versions

All versions starting from 2.5.0 up to 2.5.10, all versions starting from 2.6.0 up to 2.6.7, all versions starting from 2.7.0 up to 2.7.6

Solution

Upgrade to version 2.7.7 or above.

Last Modified

2020-07-24

source