CVE-2021-37579
Last modified
CVE-2021-37579 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. EPSS estimates a 6.53% chance of exploitation in the next 30 days.
Description
The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Dubbo | >= 2.7.0, < 2.7.13 |
| Apache | Dubbo | >= 3.0.0, < 3.0.2 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-37579?
How severe is CVE-2021-37579?
How do I fix CVE-2021-37579?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-37571MediaTek microchips, as used in NETGEAR devices through 2021…8.8
- CVE-2021-37572MediaTek microchips, as used in NETGEAR devices through 2021…7.5
- CVE-2021-37573A reflected cross-site scripting (XSS) vulnerability in the …6.1
- CVE-2021-37576arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5…7.8
- CVE-2021-37577Bluetooth LE and BR/EDR Secure Connections pairing and Secur…6.8
- CVE-2021-37578Apache jUDDI uses several classes related to Java's Remote M…9.8
- CVE-2021-3758bookstack is vulnerable to Server-Side Request Forgery (SSRF…6.5
- CVE-2021-37580A flaw was found in Apache ShenYu Admin. The incorrect use o…9.8
- CVE-2021-37583MediaTek microchips, as used in NETGEAR devices through 2021…8.8
- CVE-2021-37584MediaTek microchips, as used in NETGEAR devices through 2021…8.8
- CVE-2021-37586The PowerPlay Web component of Mitel Interaction Recording M…4.9
- CVE-2021-37587In Charm 0.43, any single user can decrypt DAC-MACS or MA-AB…6.5
Are you affected by CVE-2021-37579?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST