CVE-2021-43297: vulnerability in Apache Dubbo
Dubbo Hessian cause RCE when parse error
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 17%
A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.
Affected products
Apache Software Foundation · Apache DubboRelated CVEs — Apache Dubbo
In the same product, most dangerous first.
CVE-2021-30181—Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)EPSS 60.9%CVE-2021-30180—Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)EPSS 60.3%CVE-2021-25641—Dubbo Zookeeper does not check serialization idEPSS 21.2%CVE-2023-29234—Bypass serialize checks in Apache DubboEPSS 7.4%CVE-2021-37579—Bypass deserialization checks in Apache DubboEPSS 6.6%CVE-2020-11995—Apache Dubbo default deserialization protocol Hessian2 cause CREEPSS 5.9%