GitHub Advisoryadvisory · Maven

GHSA-4gr7-qw2q-jxh6 Cross-site Scripting in Nacos

MEDIUM Published 2022-03-12 Modified 2025-07-18 Official page ↗
Aliases
CVE-2021-44667
Ecosystem
Maven
Packages
com.alibaba.nacos:nacos-common
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-03-14

Affected packages

• Maven com.alibaba.nacos:nacos-common: >= 2.0.0-ALPHA.1, < 2.1.0-BETA → fixed in 2.1.0-BETA • Maven com.alibaba.nacos:nacos-common: < 1.4.5 → fixed in 1.4.5

Description

A Cross Site Scripting (XSS) vulnerability exists in Nacos prior to 1.4.5 and 2.1.0-BETA in auth/users via the (1) pageSize and (2) pageNo parameters.

Related

Alias · CVE (1)

  • CVE-2021-44667 A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References