GitHub Advisoryadvisory · Maven

GHSA-qf76-pr7x-h7r4 Incorrect Access Control in Nacos

MEDIUM Published 2021-08-02 Modified 2021-04-22 Official page ↗
Aliases
CVE-2020-19676
Ecosystem
Maven
Packages
com.alibaba.nacos:nacos-common
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2021-04-22

Affected packages

• Maven com.alibaba.nacos:nacos-common: < 1.2.0 → fixed in 1.2.0

Description

Nacos 1.1.4 is affected by: Incorrect Access Control. An environment can be set up locally to get the service details interface. Then other Nacos service names can be accessed through the service list interface. Service details can then be accessed when not logged in. (detail:https://github.com/alibaba/nacos/issues/2284)

Related

Alias · CVE (1)

  • CVE-2020-19676 Nacos 1.1.4 is affected by: Incorrect Access Control. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References