CVE-2023-46279

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5.

Users are recommended to upgrade to the latest version, which fixes the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Dec 15, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-46284.3The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the ladiflow_save_hook() functiCVE-2023-462806.5A vulnerability has been identified in Security Configuration Tool (SCT) (All versions), SIMATIC Automation Tool (All versions < V5.0 SP2), CVE-2023-462818.8A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATICVE-2023-462826.1A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATICVE-2023-462837.5A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATICVE-2023-462847.5A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATICVE-2023-462857.5A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATICVE-2023-462876.1XSS exists in NagVis before 1.9.38 via the select function in share/server/core/functions/html.php.CVE-2023-462884.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2CVE-2023-462897.5Rockwell Automation FactoryTalk View Site Edition insufficiently validates user input, which could potentially allow threat actors to send mCVE-2023-46294.3The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the save_config() function in vCVE-2023-462908.1Due to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the F
CVE-2023-46279: Critical severity, CVSS 9.8 | Vulnix