Code injection in Apache Dubbo

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.

Vulnerability ID: GHSA-7wfc-x4f7-gg2x
Aliases: CVE-2021-30180
Published: 2022-03-18 17:58:01
CWE: CWE-444
CWE-94
Severity rating: CRITICAL
CVSS: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven
name: org.apache.dubbo:dubbo