What is GHSA-px4w-rcv2-6x8x?

GHSA-px4w-rcv2-6x8x is a security advisory published by GitHub Security Advisories with High severity. Arbitrary code execution in Apache ServiceComb java-chassis

Which CVE IDs does GHSA-px4w-rcv2-6x8x cover?

GHSA-px4w-rcv2-6x8x covers the following CVE IDs: CVE-2020-17532. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-px4w-rcv2-6x8x?

GHSA-px4w-rcv2-6x8x has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-px4w-rcv2-6x8x?

GHSA-px4w-rcv2-6x8x affects 2 products, including: maven/org.apache.servicecomb:java-chassis:\u003e= 1.0.0, \u003c 1.3.2; maven/org.apache.servicecomb:java-chassis:\u003e= 2.0.0, \u003c 2.1.5.

GHSA-px4w-rcv2-6x8xHighCVSS 8.8

Arbitrary code execution in Apache ServiceComb java-chassis

Vendor

GitHub Security Advisories

Published

February 9, 2022

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-17532 →

📋 Description

When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5

🎯 Affected products2

maven/org.apache.servicecomb:java-chassis:>= 1.0.0, < 1.3.2
maven/org.apache.servicecomb:java-chassis:>= 2.0.0, < 2.1.5

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2020-17532
https://github.com/apache/servicecomb-java-chassis/commit/839a52e27c754cb5ce14f20063902f21065bd26c
https://github.com/apache/servicecomb-java-chassis/commit/ba4fb37b6ab8bd3a6c3d0693f295d99a94879838
https://issues.apache.org/jira/browse/SCB-2145
https://seclists.org/oss-sec/2021/q1/60
https://github.com/advisories/GHSA-px4w-rcv2-6x8x