CVE-2021-30181

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Jun 1, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-301837.5Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export CVE-2021-301847.8GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN (Portable Game Notation) data. This is related to a buffer overflCVE-2021-301857.5CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link.CVE-2021-301867.5CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.CVE-2021-301875.3CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.CVE-2021-301889.8CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.CVE-2021-301899.8CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow.CVE-2021-30197.5ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet.CVE-2021-301909.8CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.CVE-2021-301917.5CODESYS V2 Web-Server before 1.1.9.20 has a a Buffer Copy without Checking the Size of the Input.CVE-2021-301929.8CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check.CVE-2021-301939.8CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write.
CVE-2021-30181: Critical severity, CVSS 9.8 | Vulnix