What is GHSA-gw4j-4229-q4px?

GHSA-gw4j-4229-q4px is a security advisory published by GitHub Security Advisories with Medium severity. Server-Side Request Forgery in Apache Dubbo

Which CVE IDs does GHSA-gw4j-4229-q4px cover?

GHSA-gw4j-4229-q4px covers the following CVE IDs: CVE-2021-25640. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gw4j-4229-q4px?

GHSA-gw4j-4229-q4px has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-gw4j-4229-q4px?

GHSA-gw4j-4229-q4px affects 2 products, including: maven/org.apache.dubbo:dubbo:\u003e= 2.5.0, \u003c 2.7.10; maven/com.alibaba:dubbo:\u003e= 2.5.0, \u003c 2.6.9.

GHSA-gw4j-4229-q4pxMediumCVSS 6.1

Server-Side Request Forgery in Apache Dubbo

Vendor

GitHub Security Advisories

Published

March 18, 2022

Last Modified

January 29, 2023

🔗 CVE IDs covered (1)

CVE-2021-25640 →

📋 Description

In Apache Dubbo prior to 2.6.9 and 2.7.10, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.

🎯 Affected products2

maven/org.apache.dubbo:dubbo:>= 2.5.0, < 2.7.10
maven/com.alibaba:dubbo:>= 2.5.0, < 2.6.9

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-25640
https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77%40%3Cdev.dubbo.apache.org%3E
https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77@%3Cdev.dubbo.apache.org%3E
https://github.com/advisories/GHSA-gw4j-4229-q4px