VulnerabilityModified
CVE-2020-1948
This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower.
CRITICAL 9.8EPSS 15.8%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 15.8%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 15.83% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-502
- Affected
- apache/dubbo
- Source
- security@apache.org
References
- https://lists.apache.org/thread.html/rbaa41711b3e7a8cd20e9013737423ddd079ddc12f90180f86e76523c%40%3Csecurity.dubbo.apache.org%3EBroken Link
- https://nsfocusglobal.com/apache-dubbo-remote-code-execution-vulnerability-cve-2020-1948-threat-alert/Third Party Advisory
- https://lists.apache.org/thread.html/rbaa41711b3e7a8cd20e9013737423ddd079ddc12f90180f86e76523c%40%3Csecurity.dubbo.apache.org%3EBroken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.