Skip to content
CVE PROGRAM SOURCE RECORD5.0 Medium

CVE-2023-23638

Apache Dubbo Deserialization Vulnerability Gadgets Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Dubbo

Default version status: unaffected

  • Apache Dubbo 2.7.x to ≤ 2.7.21affected
  • Apache Dubbo 3.0.x to ≤ 3.0.13affected
  • Apache Dubbo 3.1.x to ≤ 3.1.5affected

References