Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2022-39198

Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Dubbo

  • Apache Dubbo 2.7.x to ≤ 2.7.17affected
  • Apache Dubbo 3.0.x to ≤ 3.0.11affected
  • Apache Dubbo 3.1.x to ≤ 3.1.0affected

References