CVE-2021-25640

Published: May 31, 2021

Modified: Aug 3, 2024

PUBLISHED

Description

In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.

Vendor	Product	Versions
Apache Software Foundation	Apache Dubbo	affected `Apache Dubbo 2.7.x - < 2.7.9` affected `Apache Dubbo 2.6.x - < 2.6.9`

Weaknesses (CWE)

CWE-918

References

https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77%40%3Cdev.dubbo.apache.org%3E

x_refsource_MISC

[dubbo-dev] 20210531 [CVE-2021-25640] Open Redirect or SSRF vulnerability usage of parseURL

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2021-25640

Description

Affected Products

Weaknesses (CWE)

References