CVE-2021-36163

Name of the Vulnerable Software and Affected Versions Apache Dubbo versions prior to 2.7.13 Apache Dubbo versions prior to 2.6.10.1

Description The issue concerns the Hessian protocol in Apache Dubbo, which is implemented on top of HTTP. The HessianSkeleton is created without configuration of the serialization factory, and thus without applying allowed or blocked type lists. Additionally, the generic service is always exposed, making it easier for attackers as they do not need to find a valid service/method name pair.

Recommendations For versions prior to 2.7.13, update to version 2.7.13 or later. For versions prior to 2.6.10.1, update to version 2.6.10.1 or later.