CVE-2022-24969

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-918 CWE-601

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Dubbo	>= Apache Dubbo 2.7.x, < 2.7.15; >= Apache Dubbo 2.6.x, <= 2.6.12

References

https://lists.apache.org/thread/1xbckc3467wfk5r7n2o44r2brdsbwxgrBroken Link
https://lists.apache.org/thread/1xbckc3467wfk5r7n2o44r2brdsbwxgrBroken Link

Timeline

Published: Jun 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-24976.4An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.0.5, all versions starting from 15.1 before CVE-2022-249718.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User intera CVE-2022-249726.5This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR940N 3.20.1 CVE-2022-249738.0This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 2 CVE-2022-249745.3Links may not be rewritten according to policy in some specially formatted emails.CVE-2022-249757.5The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could CVE-2022-249769.1Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a cert CVE-2022-249779.8ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to u CVE-2022-249788.8Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password CVE-2022-249795.3An issue was discovered in the Varnishcache extension before 2.0.1 for TYPO3. The Edge Site Includes (ESI) content element renderer componen CVE-2022-24987.5An issue in pipeline subscriptions in GitLab EE affecting all versions from 12.8 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15 CVE-2022-249807.5An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A m