CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2022-24969
bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.
Severity
- EPSS
- 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-601, CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:dubbo
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-gm48-83x4-84jg | Maven | org.apache.dubbo:dubbo | >=2.5.0 <2.7.15 | 2.7.15 |
| GHSA-gm48-83x4-84jg | Maven | com.alibaba:dubbo | >=2.5.0 <2.6.12 | 2.6.12 |