GHSA-7wfc-x4f7-gg2xCriticalCVSS 9.8

Code injection in Apache Dubbo

Published
March 18, 2022
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-30180 →

📋 Description

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.

🎯 Affected products1

  • maven/org.apache.dubbo:dubbo:>= 2.7.0, < 2.7.10

🔗 References (3)