CVE-2022-24969 Security Details

CVE ID

CVE-2022-24969

CWE

CWE-601

CWE-918

CVE Description

bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.

Published

Jun 10, 2022

CVSS Score & Severity

6.1Medium

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

2.387%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

com/alibaba/dubbo/common/URL.valueOf(Ljava/lang/String;)Lcom/alibaba/dubbo/common/URL;

JVMVulnerable params: 0

org/apache/dubbo/common/URLStrParser.parseURLBody(Ljava/lang/String;Ljava/lang/String;Ljava/util/Map;)Lorg/apache/dubbo/common/URL;

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

Apache · AnnouncementPROJECT