{"api_version":"1","generated_at":"2026-07-23T10:54:49+00:00","cve":"CVE-2020-1948","urls":{"html":"https://cve.report/CVE-2020-1948","api":"https://cve.report/api/cve/CVE-2020-1948.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-1948","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-1948"},"summary":{"title":"CVE-2020-1948","description":"This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.","state":"PUBLIC","assigner":"security@apache.org","published_at":"2020-07-14 14:15:00","updated_at":"2020-07-21 17:50:00"},"problem_types":["CWE-502"],"metrics":[],"references":[{"url":"https://lists.apache.org/thread.html/rbaa41711b3e7a8cd20e9013737423ddd079ddc12f90180f86e76523c%40%3Csecurity.dubbo.apache.org%3E","name":"https://lists.apache.org/thread.html/rbaa41711b3e7a8cd20e9013737423ddd079ddc12f90180f86e76523c%40%3Csecurity.dubbo.apache.org%3E","refsource":"MISC","tags":["Broken Link"],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://nsfocusglobal.com/apache-dubbo-remote-code-execution-vulnerability-cve-2020-1948-threat-alert/","name":"https://nsfocusglobal.com/apache-dubbo-remote-code-execution-vulnerability-cve-2020-1948-threat-alert/","refsource":"MISC","tags":["Third Party Advisory"],"title":"Apache Dubbo Remote Code Execution Vulnerability (CVE-2020-1948) Threat Alert - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-1948","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1948","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"1948","vulnerable":"1","versionEndIncluding":"2.5.10","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"dubbo","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"1948","vulnerable":"1","versionEndIncluding":"2.6.7","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"dubbo","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"1948","vulnerable":"1","versionEndIncluding":"2.7.6","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"dubbo","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2020-1948","ASSIGNER":"security@apache.org","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"n/a","product":{"product_data":[{"product_name":"Apache Dubbo","version":{"version_data":[{"version_value":"Apache Dubbo 2.5.x, 2.6.0 to 2.6.8, 2.7.0 to 2.7.7"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Remote Code Execution through Deserialization"}]}]},"references":{"reference_data":[{"refsource":"MISC","name":"https://lists.apache.org/thread.html/rbaa41711b3e7a8cd20e9013737423ddd079ddc12f90180f86e76523c%40%3Csecurity.dubbo.apache.org%3E","url":"https://lists.apache.org/thread.html/rbaa41711b3e7a8cd20e9013737423ddd079ddc12f90180f86e76523c%40%3Csecurity.dubbo.apache.org%3E"}]},"description":{"description_data":[{"lang":"eng","value":"This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below."}]}},"nvd":{"publishedDate":"2020-07-14 14:15:00","lastModifiedDate":"2020-07-21 17:50:00","problem_types":["CWE-502"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.0","versionEndIncluding":"2.6.7","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*","versionStartIncluding":"2.5.0","versionEndIncluding":"2.5.10","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*","versionStartIncluding":"2.7.0","versionEndIncluding":"2.7.6","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"1948","Ordinal":"161349","Title":"CVE-2020-1948","CVE":"CVE-2020-1948","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"1948","Ordinal":"1","NoteData":"This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"1948","Ordinal":"2","NoteData":"2020-07-14","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"1948","Ordinal":"3","NoteData":"2020-07-14","Type":"Other","Title":"Modified"}]}}}