Vulnerability · Published Jan 25, 2021 · Assigned by apache
CVE-2020-17532Apache ServiceComb Yaml remote deserialization vulnerability
High 8.8
In plain English
A high-severity improper input validation in Apache ServiceComb-Java-Chassis from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)8.8High
Exploit odds (30 days)3.4%top 11.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.servicecomb:java-chassis | 1.3.2 | GHSA-px4w-rcv2-6x8x |
| Maven | org.apache.servicecomb:java-chassis | 2.1.5 | GHSA-px4w-rcv2-6x8x |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache ServiceComb-Java-Chassis | Apache ServiceComb-Java-Chassis 2.x 2.0.0 to 2.1.3 |
Weakness: CWE-20
References
- https://seclists.org/oss-sec/2021/q1/60 x_refsource_MISC
- https://issues.apache.org/jira/browse/SCB-2145 x_refsource_MISC