5.0
Medium
CVE-2023-23638 A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution
Description
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Dubbo 3.1 | earliest → 3.1.5 | No fix stated |
| Apache Dubbo 3.0 | earliest → 3.0.13 | No fix stated |
| Apache Dubbo 2.7 | earliest → 2.7.21 | No fix stated |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Dubbo
The 16 CVEs of Apache Dubbo →
CVE-2023-46279
Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5
Not rated
CVE-2023-29234
A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0…
Not rated
CVE-2022-39198
A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to…
Not rated
CVE-2022-24969
bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass…
Not rated