WaratekVRT Sign in

CVE-2020-1948 Dubbo

Affected softwareDubbo
Severity9.8 Critical CVSS 3.1 2 scores
Fixed in2.7.7
WeaknessDeserialization of untrusted data (CWE-502)
Published14 Jul 2020
Updated17 Jun 2026

Description

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.

Exploitation status

Proof of concept only

A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 4 indexed Published artifacts you can open, in GitHub PoC; first seen 2020-06-27.
  • EPSS 16% chance in 30 days A model's forecast, not a report of exploitation. Higher than 97% of all scored CVEs.

3 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC ctlyz123/CVE-2020-1948 14 2020-06-27
GitHub PoC Apache Dubbo CVE-2020-1948 漏洞测试环境，亲测可用。 4 2020-07-04
GitHub PoC M3g4Byt3/cve-2020-1948-poc 3 2020-07-09
GitHub PoC [CVE-2020-1948] Apache Dubbo Provider default deserialization cause RCE 2020-08-11

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A vulnerability class already blocked by an ARMR security rule
Finding Protected by Waratek's ARMR deserialization security rule, which blocks this class of attack at the JVM level without a rule written for this CVE specifically. The CVE's weakness is CWE-502: Deserialization of Untrusted Data.

How to mitigate CVE-2020-1948

Upgrade Dubbo to 2.7.7 or later. Until you can, Waratek RASP blocks exploitation with its deserialization and process rules. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.apache.dubbo:dubbo 0 2.7.7 unbounded
org.apache.dubbo:dubbo-common 0 2.7.7 unbounded

Products and versions

3 products, 5 version entries
SourceVendorProductSchemeAffected versions
nvd apache dubbo generic ≥ 2.5.0 and ≤ 2.5.10 · ≥ 2.6.0 and ≤ 2.6.7 · ≥ 2.7.0 and ≤ 2.7.6
osv org.apache.dubbo dubbo generic ＜ 2.7.7
osv org.apache.dubbo dubbo-common generic ＜ 2.7.7

References

URLTags
https://lists.apache.org/thread.html/rbaa41711b3e7a8cd20e9013737423ddd079ddc12f90180f86e76523c%40%3Csecurity.dubbo.apache.org%3E WEB
https://nsfocusglobal.com/apache-dubbo-remote-code-execution-vulnerability-cve-2020-1948-threat-alert WEB
https://nsfocusglobal.com/apache-dubbo-remote-code-execution-vulnerability-cve-2020-1948-threat-alert/ Third Party Advisory

Timeline
Published2020-07-14By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.