We found results for “”
CVE-2021-25640
Good to know:
Date: June 1, 2021
In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.
Language: Java
Severity Score
Related Resources (4)
Severity Score
Weakness Type (CWE)
Top Fix
Upgrade Version
Upgrade to version com.alibaba:dubbo:2.6.9;org.apache.dubbo:dubbo:2.7.10;org.apache.dubbo:dubbo-common:2.7.10
CVSS v3.1
Base Score: |
|
---|---|
Attack Vector (AV): | NETWORK |
Attack Complexity (AC): | LOW |
Privileges Required (PR): | NONE |
User Interaction (UI): | REQUIRED |
Scope (S): | CHANGED |
Confidentiality (C): | LOW |
Integrity (I): | LOW |
Availability (A): | NONE |
CVSS v2
Base Score: |
|
---|---|
Access Vector (AV): | NETWORK |
Access Complexity (AC): | MEDIUM |
Authentication (AU): | NONE |
Confidentiality (C): | PARTIAL |
Integrity (I): | PARTIAL |
Availability (A): | NONE |
Additional information: |