1. Home
  2. Vulnerabilities
  3. CVE-2020-1948

CVE-2020-1948

CVSS v3.1 9.8 (Critical)
98% Progress
CVSS v2.0 7.5 (High)
75% Progress
EPSS 0.41 % (74th)
0.41% Progress
Affected Products 1
Advisories 1
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software Tools, Exploits & PoC Graph Web & Social Timeline

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.

Weaknesses
CWE-502
Deserialization of Untrusted Data
CVE Status
PUBLISHED
CNA
Apache Software Foundation
Published Date
2020-07-14 14:15:17
(4 years ago)
Updated Date
2020-07-21 17:50:26
(4 years ago)

Affected Products

Apache

Configuration #1

    CPE23 From Up To
  Apache Dubbo from 2.5.0 version and 2.5.10 and prior versions cpe:2.3:a:apache:dubbo >= 2.5.0 <= 2.5.10
  Apache Dubbo from 2.6.0 version and 2.6.7 and prior versions cpe:2.3:a:apache:dubbo >= 2.6.0 <= 2.6.7
  Apache Dubbo from 2.7.0 version and 2.7.6 and prior versions cpe:2.3:a:apache:dubbo >= 2.7.0 <= 2.7.6