{"affected":[{"affectedData":[{"product":"Apache Dubbo","vendor":"n/a","versions":[{"status":"affected","version":"Apache Dubbo 2.5.x, 2.6.0 to 2.6.8, 2.7.0 to 2.7.7"}]}],"source":"security@apache.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*","matchCriteriaId":"6AA9088D-71FA-4DE0-9DC9-DBE0CCB0AB6B","versionEndIncluding":"2.5.10","versionStartIncluding":"2.5.0","vulnerable":true},{"criteria":"cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*","matchCriteriaId":"444DA191-F4F8-4AF7-B6DD-7934715E53BC","versionEndIncluding":"2.6.7","versionStartIncluding":"2.6.0","vulnerable":true},{"criteria":"cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*","matchCriteriaId":"C27B7D1F-00B6-46C6-863A-7CC1D20574DF","versionEndIncluding":"2.7.6","versionStartIncluding":"2.7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below."},{"lang":"es","value":"Esta vulnerabilidad puede afectar a todos los usuarios de Dubbo que permanecen en las versiones 2.7.6 o por debajo. Un atacante puede enviar peticiones RPC con un nombre de servicio o nombre de método no reconocido junto con algunas cargas útiles de parámetros maliciosos. Cuando el parámetro malicioso es deserializado, ejecutará algún código malicioso. Más detalles pueden ser encontrados a continuación"}],"id":"CVE-2020-1948","lastModified":"2026-06-17T03:02:42.117","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2020-07-14T14:15:17.790","references":[{"source":"security@apache.org","tags":["Broken Link"],"url":"https://lists.apache.org/thread.html/rbaa41711b3e7a8cd20e9013737423ddd079ddc12f90180f86e76523c%40%3Csecurity.dubbo.apache.org%3E"},{"source":"nvd@nist.gov","tags":["Third Party Advisory"],"url":"https://nsfocusglobal.com/apache-dubbo-remote-code-execution-vulnerability-cve-2020-1948-threat-alert/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"url":"https://lists.apache.org/thread.html/rbaa41711b3e7a8cd20e9013737423ddd079ddc12f90180f86e76523c%40%3Csecurity.dubbo.apache.org%3E"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"nvd@nist.gov","type":"Primary"}]}