by Kastro
Paper/Archive/CVE-2020-1948

CVE-2020-1948

apache — This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower.

EPSS 16%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 97.0.970 × 2019.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.

Affected

ProductAffectedFixed inSource
Apache DubboApache Dubbo 2.5.x, 2.6.0 to 2.6.8, 2.7.0 to 2.7.7–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reflists.apache.org/thread.html/rbaa41711b3e7a8cd20e9013737423ddd079ddc12f90180f86e76523c%40%3Csecurity.dubbo.apache.org%3E