CVE-2022-39198 Security Details

CVE ID

CVE-2022-39198

CWE

CWE-502

CVE Description

A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.

Published

Oct 19, 2022

CVSS Score & Severity

9.8Critical

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

10.341%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

com/alibaba/com/caucho/hessian/io/SerializerFactory.getDeserializer(Ljava/lang/Class;)Lcom/alibaba/com/caucho/hessian/io/Deserializer;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

Apache · AnnouncementTHIRD_PARTY