Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2020-1948

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malici

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a Apache Dubbo

  • Apache Dubbo 2.5.x, 2.6.0 to 2.6.8, 2.7.0 to 2.7.7affected

References