title: Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass
description: A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.
problem types: CWE-502 Deserialization of Untrusted Data
affected:
{
vendor: Apache Software Foundation
product: Apache Dubbo
versions:
version: Apache Dubbo 2.7.x, status: affected, lessThanOrEqual: 2.7.17, versionType: custom
version: Apache Dubbo 3.0.x, status: affected, lessThanOrEqual: 3.0.11, versionType: custom
version: Apache Dubbo 3.1.x, status: affected, lessThanOrEqual: 3.1.0, versionType: custom
}
metrics:
other: [
type: unknown
content: {'other': 'moderate'}
]