Description (CNA)
In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Apache Software Foundation / Apache Dubbo | affected Apache Dubbo 2.7.x before 2.7.9; affected Apache Dubbo 2.6.x before 2.6.9 |
CWE
CWE-918
References
- https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77%40%3Cdev.dubbo.apache.org%3E
- https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77%40%3Cdev.dubbo.apache.org%3E
ADP enrichment
No English description supplied.