{"action":"Upgrade org.apache.dubbo:dubbo-common to 2.7.7 or later.","affected":[{"fixed":"2.7.7","introduced":"0"}],"component":"org.apache.dubbo:dubbo-common","cve_ids":["CVE-2020-1948"],"ecosystem":"Maven","epss":0.16441,"exploited":false,"fixed_versions":["2.7.7"],"ghsa_id":"GHSA-whww-v56c-cgv2","id":"tcs_01M5N9GJTX2KZEJMZEFMHXA4Z7","modified_at":"2024-02-17T05:34:59.276780Z","published_at":"2022-02-10T22:39:17Z","references":["https://osv.dev/vulnerability/GHSA-whww-v56c-cgv2","https://nvd.nist.gov/vuln/detail/CVE-2020-1948","https://lists.apache.org/thread.html/rbaa41711b3e7a8cd20e9013737423ddd079ddc12f90180f86e76523c%40%3Csecurity.dubbo.apache.org%3E","https://nsfocusglobal.com/apache-dubbo-remote-code-execution-vulnerability-cve-2020-1948-threat-alert"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-whww-v56c-cgv2#Maven/org.apache.dubbo:dubbo-common","url":"https://osv.dev/vulnerability/GHSA-whww-v56c-cgv2"}],"summary":"Deserialization of Untrusted Data in Apache Dubbo"}