by Kastro
Paper/Archive/CVE-2023-46279

CVE-2023-46279

Apache Software Foundation Apache Dubbo — Apache Dubbo: Bypass deny serialize list check in Apache Dubbo

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 76.7.767 × 2015.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrade to the latest version, which fixes the issue.

Affected

ProductAffectedFixed inSource
Apache Dubbo3.1.5–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

advisorylists.apache.org/thread/zw53nxrkrfswmk9n3sfwxmcj7x030nmorefopenwall.com/lists/oss-security/2023/12/15/3