CVE-2021-43297
Dubbo Hessian cause RCE when parse error
Vexday Risk Score
8Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS —EPSS 15.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
10 jan 2022Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.
Produtos afetados
Apache Software Foundation · Apache DubboQuer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →