title: bypass of CVE-2021-25640
description: bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.
problem types: bypass CVE-2021-25640 (CWE-918 Server-Side Request Forgery (SSRF))
affected:
{
product: Apache Dubbo
vendor: Apache Software Foundation
versions:
lessThan: 2.7.15, status: affected, version: Apache Dubbo 2.7.x, versionType: custom
lessThanOrEqual: 2.6.12, status: affected, version: Apache Dubbo 2.6.x, versionType: custom
}