CVE-2023-23638CWE-502

Apache Dubbo Deserialization Vulnerability Gadgets Bypass

Medium · published March 8, 2023

CVSS v3.1
5.0
EPSS
5%
Percentile
92.0
In the wild
Unconfirmed
What it is

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution.

This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.04847 · 92.0th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2023-03-08T10:48Z
EPSS history
Timeline
  • 08 MAR 10:48Z
    Apache Dubbo Deserialization Vulnerability Gadgets Bypass
    cvelistv5