« Volver al listado

CVE-2021-43297

Estado: ModificadaCrítica (9.8)—

A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Dubbo

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-43297",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Dubbo",
          "versions": [
            {
              "status": "affected",
              "version": "Apache Dubbo 2.6.x",
              "lessThan": "2.6.12",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "Apache Dubbo 2.7.x",
              "lessThan": "2.7.15",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "Apache Dubbo 3.0.x",
              "lessThan": "3.0.5",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-01-10T16:15:09.527",
  "references": [
    {
      "url": "https://lists.apache.org/thread/1mszxrvp90y01xob56yp002939c7hlww",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread/1mszxrvp90y01xob56yp002939c7hlww",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de deserialización en Dubbo Hessian-lite versiones 3.2.11 y sus versiones anteriores, que podría conllevar a una ejecución de código malicioso. La mayoría de usuarios de Dubbo usan Hessian2 como el protocolo de serialización/deserialización por defecto, durante la captura de excepciones no esperadas de Hessian, Hessian sacará alguna información para usuarios, lo que puede causar una ejecución de comandos remotos. Este problema afecta a  Apache Dubbo versiones 2.6.x anteriores a 2.6.12; Apache Dubbo versiones 2.7.x anteriores a 2.7.15; Apache Dubbo versiones 3.0.x anteriores a 3.0.5"
    }
  ],
  "lastModified": "2026-06-17T04:10:48.567",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C18088F-7CD5-4E22-9749-F4B703347A68",
              "versionEndExcluding": "2.6.12",
              "versionStartIncluding": "2.6.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B2FBCC30-3E2F-4826-9E57-D01F158B4184",
              "versionEndExcluding": "2.7.15",
              "versionStartIncluding": "2.7.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DCE9F3A7-DA3B-40DA-B048-68D52395DE2B",
              "versionEndExcluding": "3.0.5",
              "versionStartIncluding": "3.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}