CVE-2020-17532

Apache ServiceComb Yaml remote deserialization vulnerability

When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5

Affected

Apache Software Foundation · Apache ServiceComb-Java-Chassis

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P

EPSS

3.24% chance of exploitation in the next 30 days, 88th percentile

Published

2021-01-25

Updated

2025-02-13

Exploit collections (1)

• CVE-2020-17532 Apache servicecomb-java-chassis Yaml 反序列化漏洞.mdtzwlhack/Vulnerability

Security advisories

• https://issues.apache.org/jira/browse/SCB-2145
• https://seclists.org/oss-sec/2021/q1/60
• advisories/GHSA-px4w-rcv2-6x8x

References

• CVE Record
• NVD entry