CVE-2019-17564: vulnerability in Apache Dubbo
Published · Updated
72Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 37%
from disclosure to weapon2381 days
Published on NVDApr 1
1st PoC+2381d
VulnCheck+1500d
exploitation probability
37%top 2% of all CVEs
observed exploitation
yesVulnCheck
1 public exploit(s)
Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.
Affected products
Apache · Apache Dubbopublic PoCs found — 1
vulncheckvulncheck.com/xdb/b9932cf09de5unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.