CVE-2021-25640

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-918 CWE-601

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Dubbo	>= Apache Dubbo 2.7.x, < 2.7.9; >= Apache Dubbo 2.6.x, < 2.6.9

References

https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory
https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory
https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory
https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory
https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory
https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory
https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory
https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory

Timeline

Published: Jun 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-256419.8Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versio CVE-2021-256428.8ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without v CVE-2021-256434.9An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @CVE-2021-256447.5An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leake CVE-2021-256454.4An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with ad CVE-2021-256468.8Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is inte CVE-2021-256475.4Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to CVE-2021-256489.8Mobile application "Testes de Codigo" 11.4 and prior allows an attacker to gain access to the administrative interface and premium features CVE-2021-256495.5An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Utility Services. This vulnerabili CVE-2021-256508.8A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to execute specia CVE-2021-256517.8A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to escalate privi CVE-2021-256525.5An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Appliance Virtualization Platform