A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution.
This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.
References
Link | Resource |
---|---|
https://lists.apache.org/thread/8h6zscfzj482z512d2v5ft63hdhzm0cb | Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
07 Nov 2023, 04:07
Type | Values Removed | Values Added |
---|---|---|
Summary | A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions. |
14 Mar 2023, 17:57
Type | Values Removed | Values Added |
---|---|---|
First Time |
Apache
Apache dubbo |
|
CPE | cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:* | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
References | (MISC) https://lists.apache.org/thread/8h6zscfzj482z512d2v5ft63hdhzm0cb - Issue Tracking, Vendor Advisory |
08 Mar 2023, 11:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-03-08 11:15
Updated : 2023-12-10 14:48
NVD link : CVE-2023-23638
Mitre link : CVE-2023-23638
CVE.ORG link : CVE-2023-23638
JSON object : View
Products Affected
apache
- dubbo
CWE
CWE-502
Deserialization of Untrusted Data