Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1nbTQ4LTgzeDQtODRqZ84AArex
Server-side request forgery in Apache Dubbo
bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.
Permalink: https://github.com/advisories/GHSA-gm48-83x4-84jgJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nbTQ4LTgzeDQtODRqZ84AArex
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago
CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Identifiers: GHSA-gm48-83x4-84jg, CVE-2022-24969
References:
- https://nvd.nist.gov/vuln/detail/CVE-2022-24969
- https://lists.apache.org/thread/1xbckc3467wfk5r7n2o44r2brdsbwxgr
- https://nvd.nist.gov/vuln/detail/CVE-2021-25640
- https://github.com/advisories/GHSA-gw4j-4229-q4px
- https://github.com/advisories/GHSA-gm48-83x4-84jg
Affected Packages
maven:com.alibaba:dubbo
Dependent packages: 267Dependent repositories: 13,490
Downloads:
Affected Version Ranges: >= 2.5.0, < 2.6.12
Fixed in: 2.6.12
All affected versions: 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5, 2.5.6, 2.5.7, 2.5.8, 2.5.9, 2.5.10, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11
All unaffected versions: 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.1.0, 2.1.1, 2.1.2, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 2.3.5, 2.3.6, 2.3.7, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9, 2.4.10, 2.4.11, 2.6.12
maven:org.apache.dubbo:dubbo
Dependent packages: 245Dependent repositories: 3,209
Downloads:
Affected Version Ranges: >= 2.5.0, < 2.7.15
Fixed in: 2.7.15
All affected versions: 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.7.4, 2.7.5, 2.7.6, 2.7.7, 2.7.8, 2.7.9, 2.7.10, 2.7.11, 2.7.12, 2.7.13, 2.7.14
All unaffected versions: 2.7.15, 2.7.16, 2.7.17, 2.7.18, 2.7.19, 2.7.20, 2.7.21, 2.7.22, 2.7.23, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.1.10, 3.1.11, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.2.9, 3.2.10, 3.2.11