CVE-2020-17532

Apache ServiceComb Yaml remote deserialization vulnerability

State: Published
Severity: Not scored
Published: Jan 25, 2021
Updated: Feb 13, 2025
Reserved: Aug 12, 2020

Description

When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5

Scores

The record has no CVSS score.

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
Apache ServiceComb-Java-ChassisApache Software Foundation	Apache ServiceComb-Java-Chassis 2.x 2.0.0 to 2.1.3Affected

References

https://seclists.org/oss-sec/2021/q1/60
https://issues.apache.org/jira/browse/SCB-2145

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.