CVEvulnerability

CVE-2021-29442

7.5 HIGH Published 2021-04-27 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-04-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-306

Description

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)

Affected configurations

• alibaba nacos (< 1.4.1)

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References