CVE-2021-36161
Unprotected input value toString cause RCE
- State
- Published
- Severity
- Not scored
- Published
- Sep 9, 2021
- Updated
- Aug 4, 2024
- Reserved
- Jul 6, 2021
Description
Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method. In the latest version, we fix the toString call in timeout, cache and some other places. Fixed in Apache Dubbo 2.7.13
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Apache DubboApache Software Foundation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.