CVE-2021-36163

Description

In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

1.617

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-36163 are fixed in Apache-dubbo 2.6.10.1	Windows
Vulnerabilities CVE-2021-37579,CVE-2021-36161,CVE-2021-36162,CVE-2021-36163 are fixed in Apache-dubbo 2.7.13	Windows
Vulnerabilities CVE-2021-36163 are fixed in Apache-dubbo for Linux 2.6.10.1	Linux
Vulnerabilities CVE-2021-37579,CVE-2021-36161,CVE-2021-36162,CVE-2021-36163 are fixed in Apache-dubbo for Linux 2.7.13	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234