org.apache.dubbo CVEs · No exploit published · No public exploit

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 3 matches · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5

3matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 3 100.0%

Critical 1 33.3% High 0 0.0% Medium 2 66.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 3 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 100.0%

split by StatusSeverityProtectionExploit maturity peak 1 / month

Jun 211 No exploit published1 Medium1 not blocked1 No public exploit1 Jul 210 Aug 210 Sep 211 No exploit published1 Critical1 not blocked1 No public exploit1 Oct 210 Nov 210 Dec 210 Jan 220 Feb 220 Mar 220 Apr 220 May 220 Jun 221 No exploit published1 Medium1 not blocked1 No public exploit1

Jun 21Aug 21Oct 21Dec 21Feb 22Apr 22Jun 22

3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2022-24969	Medium	2022-06-09	No exploit published	No public exploit	bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.
CVE-2021-36161	Critical	2021-09-09	No exploit published	No public exploit	Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method. In the latest version, we fix the toString call in timeout, cache and some other places. Fixed in Apache Dubbo 2.7.13
CVE-2021-25640	Medium	2021-06-01	No exploit published	No public exploit	In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2022-24969

Medium

2022-06-09

No exploit published

No public exploit

bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.

CVE-2021-36161

Critical

2021-09-09

No exploit published

No public exploit

Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method. In the latest version, we fix the toString call in timeout, cache and some other places. Fixed in Apache Dubbo 2.7.13

CVE-2021-25640

Medium

2021-06-01

No exploit published

No public exploit

In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.