PT-2021-21151
CVE-2021-36163
·
تاريخ النشر
2021-09-07
·
تاريخ التحديث
2021-09-14
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Apache Dubbo versions prior to 2.7.13
Apache Dubbo versions prior to 2.6.10.1
Description
The issue concerns the Hessian protocol in Apache Dubbo, which is implemented on top of HTTP. The HessianSkeleton is created without configuration of the serialization factory, and thus without applying allowed or blocked type lists. Additionally, the generic service is always exposed, making it easier for attackers as they do not need to find a valid service/method name pair.
Recommendations
For versions prior to 2.7.13, update to version 2.7.13 or later.
For versions prior to 2.6.10.1, update to version 2.6.10.1 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾