Skip to content
OpenAdvisories

Product · sofastack

sofa-rpc

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-23636

    SOFARPC Remote Command Execution(RCE) Vulnerbility

    SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection.…

    sofastack sofa-rpc com.alipay.sofa:rpc-sofa-boot-starter Maven
  • Critical 9.8
    CVE-2023-41331

    SOFARPC Remote Command Execution (RCE) Vulnerability

    SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefully crafted payload, an attacker can achieve JNDI injection or system command execution. In the default configuration of the SOFARPC framewor…

    sofastack sofa-rpc