CVE-2020-17532

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-502

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache ServiceComb-Java-Chassis	Apache ServiceComb-Java-Chassis 2.x 2.0.0 to 2.1.3

References

https://issues.apache.org/jira/browse/SCB-2145Mailing List, Patch, Vendor Advisory
https://seclists.org/oss-sec/2021/q1/60Mailing List, Third Party Advisory
https://issues.apache.org/jira/browse/SCB-2145Mailing List, Patch, Vendor Advisory
https://seclists.org/oss-sec/2021/q1/60Mailing List, Third Party Advisory

Timeline

Published: Jan 25, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-175338.1Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions CVE-2020-175347.0There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject CVE-2020-175385.5A buffer overflow vulnerability in GetNumSameData() in contrib/lips4/gdevlips.c of Artifex Software GhostScript from v9.18 to v9.50 allows a CVE-2020-17544.3In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not CVE-2020-175418.8Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. A remote attacker can send a malformed jpeg file CVE-2020-175425.4Cross Site Scripting (XSS) in dotCMS v5.1.5 allows remote attackers to execute arbitrary code by injecting a malicious payload into the "Tas CVE-2020-17555.3In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, X-Forwarded-For headers could be used to spoof a user's IP, in order to bypass remote addre CVE-2020-175514.8ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.CVE-2020-17567.2In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, insufficient input escaping was applied to the PHP unit webrunner admin tool.CVE-2020-175639.1Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to " /index.php?s=/admi CVE-2020-175649.1Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to the " Admin/DataActi CVE-2020-17578.1A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to un