GHSA-gm48-83x4-84jgMediumCVSS 6.1

Server-side request forgery in Apache Dubbo

Published
June 10, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-24969 →

📋 Description

bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.

🎯 Affected products2

  • maven/org.apache.dubbo:dubbo:>= 2.5.0, < 2.7.15
  • maven/com.alibaba:dubbo:>= 2.5.0, < 2.6.12

🔗 References (5)