CVE-2023-44313 is a high severity (CVSS 7.6) server side request forgery flaw in Apache ServiceComb Service-Center through version 2.1.0. The advisory says attackers can obtain sensitive server information through crafted requests. Apache recommends upgrading to version 2.2.0, which fixes the issue.
What's affected
The record and the Apache advisory agree: Apache ServiceComb Service-Center through version 2.1.0 is affected, described as before 2.1.0 inclusive, and version 2.2.0 is the fixed release. The advisory describes a server side request forgery flaw in the frontend API, through which crafted requests can return sensitive server information.
The record scores 7.6 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L. The weakness is CWE-918. The record does not mark the CVE as known exploited, and the advisory text we read does not claim exploitation. The record lists the product as Apache ServiceComb in general, while the advisory narrows it to the Service-Center component, so check that you run that component and not other ServiceComb projects.
How to check if you're exposed
- Find Service-Center in your environment. It is often deployed as a container image or a binary on a Kubernetes cluster.
- Read its version, for example from the container image tag or by running the binary with its version option. In Kubernetes,
kubectl get pods -A -o wide | grep -i service-centerand a look at the image tag help. - Versions up to and including 2.1.0 are in scope.
- Check whether the Service-Center frontend is reachable from untrusted networks.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see installed desktop software or device firmware, but it covers the open source dependencies in your own code.
What to do now
- Upgrade Apache ServiceComb Service-Center to version 2.2.0 or later.
- Keep the frontend and API behind internal networks or an authenticating proxy.
- Review which secrets are in the server's environment and rotate any that could have been exposed.
- Restrict outbound traffic from the Service-Center host to what it needs.
- Check the Apache advisory thread for later updates.
Why it matters
Server side request forgery tricks a server into making a request on the attacker's behalf. The server can reach places the attacker cannot, such as internal services and cloud metadata endpoints, and the response can reveal their contents. The vector shows user interaction is required and the impact is mainly on confidentiality.
A service registry is trusted by the other services around it and often sits inside a private network. That position is what makes a request forgery flaw interesting to an attacker.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What can an attacker obtain?
The advisory says sensitive server information through specially crafted requests.
Which version fixes it?
Apache ServiceComb Service-Center 2.2.0.
Sources
Last reviewed: 19 October 2026.
