PT-2022-17019 · Apache · Apache Dubbo

Published 2022-06-06 · Updated 2022-06-15 · CVE-2022-24969

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Dubbo versions prior to 2.6.12 and 2.7.15

Description The issue arises from the usage of the parseURL method, which can lead to the bypass of the white host check. This can cause open redirect or Server-Side Request Forgery (SSRF) issues. SSRF occurs when an attacker can manipulate a server into making unauthorized requests, potentially leading to access of sensitive data or systems.

Recommendations For versions prior to 2.6.12, update to version 2.6.12 or later. For versions prior to 2.7.15, update to version 2.7.15 or later.

Fix

Open Redirect

SSRF

Weakness Enumeration

CWE-601

CWE-918

Related Identifiers

CVE-2022-24969

GHSA-GM48-83X4-84JG

Affected Products

Apache Dubbo

References · 7

• https://osv.dev/vulnerability/CVE-2022-24969 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24969 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-25640 · Security Note
• https://osv.dev/vulnerability/GHSA-gm48-83x4-84jg · Vendor Advisory
• https://lists.apache.org/thread/1xbckc3467wfk5r7n2o44r2brdsbwxgr · Note
• https://github.com/advisories/GHSA-gw4j-4229-q4px · Note
• https://t.me/cibsecurity/44120 · Telegram Post