CVE-2020-17532CWE-20

Apache ServiceComb Yaml remote deserialization vulnerability

published January 25, 2021

CVSS
—
EPSS
3%
Percentile
88.7
In the wild
Unconfirmed
What it is

When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03381 · 88.7th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2021-01-25T09:25Z
EPSS history
Timeline
  • 25 JAN 09:25Z
    Apache ServiceComb Yaml remote deserialization vulnerability
    cvelistv5