cve.bz

CVE-2020-1948

9.8 criticalEPSS 16%

Critical (9.8) in apache dubbo. EPSS 16% chance of exploitation in the next 30 days. Fixed in org.apache.dubbo:dubbo 2.7.7.

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
16% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWE
CWE-502
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-whww-v56c-cgv2Mavenorg.apache.dubbo:dubbo<2.7.72.7.7
GHSA-whww-v56c-cgv2Mavenorg.apache.dubbo:dubbo-common<2.7.72.7.7

References

Check your stackJSON