CVE-2022-39198
Assigner: apache
Published: 2022-10-18T00:00:00
State: PUBLISHED
title: Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass
descriptions: value: A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.
affected: vendor: Apache Software Foundation
product: Apache Dubbo
versions: version: Apache Dubbo 2.7.x
status: affected
lessThanOrEqual: 2.7.17
versionType: custom
version: Apache Dubbo 3.0.x
status: affected
lessThanOrEqual: 3.0.11
versionType: custom
version: Apache Dubbo 3.1.x
status: affected
lessThanOrEqual: 3.1.0
versionType: custom
credits: value: yemoli&cxc
metrics: other: type: unknown
content: other: moderate
problemTypes: descriptions: type: CWE
description: CWE-502 Deserialization of Untrusted Data
cweId: CWE-502
x_generator: engine: Vulnogram 0.0.9
source: discovery: UNKNOWN