WaratekVRT Sign in
Reset
More filters (1)
Columns
Product dubbo✕
Overview 12 matches · 1 exploited · 0 CISA KEV · 4 public PoC · 0 EPSS ≥ 0.5
12matches 1exploited8.3% 0CISA KEV0.0% 4public PoC33.3% 0EPSS ≥ 0.50.0%
Protected by Waratek 12 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 11 91.7% High 1 8.3% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 12 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 8.3% Working exploit published 0 0.0% Proof of concept only 3 25.0% Forecast only 0 0.0% No public exploit 8 66.7%
split by peak 3 / quarter
Protected by Waratek: 12 High: 1Critical: 11 blocked by ARMR today: 12 No public exploit: 8Proof of concept only: 3Exploited: 1
Q2 201 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 Q3 201 Protected by Waratek1 Critical1 blocked by ARMR today1 Proof of concept only1 Q4 200 Q1 211 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q2 211 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q3 213 Protected by Waratek3 Critical2 High1 blocked by ARMR today3 No public exploit3 Q4 210 Q1 221 Protected by Waratek1 Critical1 blocked by ARMR today1 Proof of concept only1 Q2 220 Q3 220 Q4 221 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q1 231 Protected by Waratek1 Critical1 blocked by ARMR today1 Proof of concept only1 Q2 230 Q3 230 Q4 232 Protected by Waratek2 Critical2 blocked by ARMR today2 No public exploit2
Q2 20Q4 20Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23
12 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-46279 Critical 2023-12-15 Protected by Waratek No public exploit Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrade to the latest version, which fixes the issue.
CVE-2023-29234 Critical 2023-12-15 Protected by Waratek No public exploit A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. Users are recommended to upgrade to the latest version, which fixes the issue.
CVE-2023-23638 Critical 2023-03-08 Protected by Waratek Proof of concept only A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.
CVE-2022-39198 Critical 2022-10-18 Protected by Waratek No public exploit A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.
CVE-2021-43297 Critical 2022-01-10 Protected by Waratek Proof of concept only A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.
CVE-2021-37579 Critical 2021-09-09 Protected by Waratek No public exploit The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found.
CVE-2021-36163 Critical 2021-09-07 Protected by Waratek No public exploit In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1
CVE-2021-36162 High 2021-09-07 Protected by Waratek No public exploit Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). These rules are loaded into the configuration center (eg: Zookeeper, Nacos, ...) and retrieved by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers will use SnakeYAML library to load the rules which by default will enable calling arbitrary constructors. An attacker with access to the configuration center he will be able to poison the rule so when retrieved by the consumers, it will get RCE on all of them. This was fixed in Dubbo 2.7.13, 3.0.2
CVE-2021-30179 Critical 2021-06-01 Protected by Waratek No public exploit Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API to make the final call. The signature for the $invoke or $invokeAsync methods is Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the name of the method to invoke, the second one is an array with the parameter types for the method being invoked and the third one is an array with the actual call arguments. In addition, the caller also needs to set an RPC attachment specifying that the call is a generic call and how to decode the arguments. The possible values are: - true - raw.return - nativejava - bean - protobuf-json An attacker can control this RPC attachment and set it to nativejava to force the java deserialization of the byte array located in the third argument.
CVE-2020-11995 Critical 2021-01-11 Protected by Waratek No public exploit A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HasMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo 2.6.9 and 2.7.8.
CVE-2020-1948 Critical 2020-07-14 Protected by Waratek Proof of concept only This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.
CVE-2019-17564 Critical 2020-04-01 Protected by Waratek Exploited Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.