Detections
Analytics

SCA: security update for com.alibaba:dubbo, org.apache.dubbo:dubbo (GHSA-5mc7-m686-p6jg)

critical Tenable Self-Hosted Container Security Plugin ID 410918

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by
 provider interfaces. These invocations are handled by the GenericFilter which will find the service and
 method specified in the first arguments of the invocation and use the Java Reflection API to make the
 final call. The signature for the $invoke or $invokeAsync methods is
 Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the name of the
 method to invoke, the second one is an array with the parameter types for the method being invoked and the
 third one is an array with the actual call arguments. In addition, the caller also needs to set an RPC
 attachment specifying that the call is a generic call and how to decode the arguments. The possible values
 are: - true - raw.return - nativejava - bean - protobuf-json An attacker can control this RPC attachment
 and set it to nativejava to force the java deserialization of the byte array located in the third
 argument. (CVE-2021-30179)

See Also

https://github.com/advisories/GHSA-5mc7-m686-p6jg

Plugin Details

Severity: Critical

ID: 410918

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 97.35

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-30179

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/18/2022

Vulnerability Publication Date: 5/31/2021

Reference Information

CVE: CVE-2021-30179

cwe: CWE-502