Nacos 2.0.3 Access Control

Exploit Title: Nacos 2.0.3 - Access Control vulnerability Date: 2023-01-17 Exploit Author: Jenson Zhao Vendor Homepage: https://nacos.io/ Software Link: https://github.com/alibaba/nacos/releases/ Version: Up to including2.0.3 Tested on: Windows 10 CVE : CVE-2021-43116 Required before execution: p...

Nacos 2.0.3 - Access Control vulnerability

Exploit Title: Nacos 2.0.3 - Access Control vulnerability Date: 2023-01-17 Exploit Author: Jenson Zhao Vendor Homepage: https://nacos.io/ Software Link: https://github.com/alibaba/nacos/releases/ Version: Up to including2.0.3 Tested on: Windows 10 CVE : CVE-2021-43116 Required before execution: p...

com.alibaba.csp:sentinel-datasource-nacos (1.3.0-ga), com.nepxion:discovery-common-nacos (>=3.7.12, <=4.8.0-rc1) +8 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (0.3.0)

com.alibaba.nacos:nacos-client MAVEN version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.3.0-ga - com.nepxion:discovery-common-nacos =3.7.12,...

cc.jweb:jweb-adai (>=1.0.2, <=1.0.6), cc.jweb:jweb-boot (>=1.0.2, <=1.0.5) +393 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (1.4.1)

com.alibaba.nacos:nacos-client MAVEN version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - cc.jweb:jweb-adai =1.0.2, =1.0.2, =1.0.4.r, =1.0.0.release, =0.0.2.1, =0.0.2.1, =1.0.0, =1.0.0,...

org.dromara.dynamictp:dynamic-tp-example-nacos (>=1.2.1-beta, <=1.2.2), org.noear:nacos-solon-cloud-plugin (>=2.7.3, <=3.0.0-rc2) potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (1.4.7)

com.alibaba.nacos:nacos-client MAVEN version 1.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - org.dromara.dynamictp:dynamic-tp-example-nacos =1.2.1-beta, =2.7.3, =3.0.0-rc2 Source cves:...

cn.iisme.cloud:iisme-demos-nacos-core (1.0.1), cn.iisme.cloud:iisme-demos-nacos-web (1.0.1) +26 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (0.8.0)

com.alibaba.nacos:nacos-client MAVEN version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - cn.iisme.cloud:iisme-demos-nacos-core 1.0.1 - cn.iisme.cloud:iisme-demos-nacos-web 1.0.1 -...

org.nutz:nutzboot-starter-nacos-config-client (>=2.3.1.v20190318, <=2.3.7.v20190731) potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (0.9.0)

com.alibaba.nacos:nacos-client MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - org.nutz:nutzboot-starter-nacos-config-client =2.3.1.v20190318, =2.3.7.v20190731 Source cves:...

com.github.zgqq:flycat-config-nacos (0.1.2), com.github.zgqq:flycat-springboot-dubbo (0.1.2) +7 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (0.9.1)

com.alibaba.nacos:nacos-client MAVEN version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - com.github.zgqq:flycat-config-nacos 0.1.2 - com.github.zgqq:flycat-springboot-dubbo 0.1.2 -...

io.github.leonside:springleaf-cloud-smart-discovery-nacos (>=1.0.release, <=1.0.1), io.github.leonside:springleaf-cloud-smart-discovery-nacos-sample (>=1.0.0, <=1.0.1) potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (1.0.1)

com.alibaba.nacos:nacos-client MAVEN version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - io.github.leonside:springleaf-cloud-smart-discovery-nacos =1.0.release, =1.0.0, =1.0.1 Source cves:...

com.nepxion:discovery-common-nacos (>=3.8.0, <=4.8.0), com.nepxion:discovery-console-starter-nacos (>=3.8.0, <=4.8.0) +3 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (0.5.0)

com.alibaba.nacos:nacos-client MAVEN version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - com.nepxion:discovery-common-nacos =3.8.0, =3.8.0, =3.8.0, =3.8.0, =3.8.0, =4.8.0 Source cves:...

com.alibaba:dubbo-registry-nacos (0.0.1), com.alipay.sofa:rpc-sofa-boot-core (>=5.5.0, <=6.0.1) +2 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (0.6.0)

com.alibaba.nacos:nacos-client MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - com.alibaba:dubbo-registry-nacos 0.0.1 - com.alipay.sofa:rpc-sofa-boot-core =5.5.0, =5.5.0, =5.5.0,...

com.alibaba.csp:sentinel-datasource-nacos (1.4.1), com.nepxion:discovery-common-nacos (>=edgware.1.0.0, <=4.8.5.2) +12 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (0.6.2)

com.alibaba.nacos:nacos-client MAVEN version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.4.1 - com.nepxion:discovery-common-nacos =edgware.1.0.0...

cc.cc4414:cc-spring-cloud-starter (>=0.3.0, <=0.5.0), cc.cc4414:cc-spring-cloud-starter-gateway (0.5.0) +46 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (1.1.1)

com.alibaba.nacos:nacos-client MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - cc.cc4414:cc-spring-cloud-starter =0.3.0, =1.1, =1.1, =0.1.3, =1.00, =a.1.1.2, =a.1.1.2, =0.1.2,...

cn.geminis.dependency:geminis-dependency-service (>=1.4.0, <=2021.6.0), cn.springcloud.gray:spring-cloud-gray-plugin-ribbon-nacos-discovery (d.0.1.0-beta-3) +131 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (1.2.1)

com.alibaba.nacos:nacos-client MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - cn.geminis.dependency:geminis-dependency-service =1.4.0, =2.0.2.release, =2.0.2.release, =2.7.6,...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config (>=2.0.3.release, <=2.2.3.release), com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-discovery (>=2.0.3.release, <=2.2.3.release) +54 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (1.3.3)

com.alibaba.nacos:nacos-client MAVEN version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config =2.0.3.release, =2.0.3.release, =1.0.0,...

org.noear:nacos-solon-cloud-plugin (>=2.3.0, <=2.7.3-m3), org.noear:solon-cloud-alibaba (>=2.3.0, <=2.3.2) potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (1.4.5)

com.alibaba.nacos:nacos-client MAVEN version 1.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - org.noear:nacos-solon-cloud-plugin =2.3.0, =2.3.0, =2.3.2 Source cves: CVE-2021-43116 Source...

cc.uncarbon.framework:helio-starter-cloud (>=1.2.1, <=1.4.0), cn.crushes.cloud:crush-alibaba (2.5.0) +318 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (>=2.0.0-beta, <=2.0.3)

com.alibaba.nacos:nacos-client MAVEN version =2.0.0-beta, =1.2.1, =1.0.0, =1.2.2.release, =1.2.2.release, =1.2.2.release, =1.2.2.release, =1.2.2.release, =1.2.3-release, =1.5.3 and more Source cves: CVE-2021-43116 Source advisory: GHSA-2G86-R6W2-WQQR...

cc.cc4414:cc-spring-cloud-starter (>=0.5.1, <=0.7.0), cc.cc4414:cc-spring-cloud-starter-gateway (>=0.5.1, <=0.7.0) +108 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (1.1.4)

com.alibaba.nacos:nacos-client MAVEN version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - cc.cc4414:cc-spring-cloud-starter =0.5.1, =0.5.1, =5.2.7-nacos, =5.2.7-nacos, =5.2.7-nacos, =0.1.4,...

org.noear:nacos-solon-cloud-plugin (>=3.0.0-rc3, <=4.1.1) potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (1.4.8)

com.alibaba.nacos:nacos-client MAVEN version 1.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - org.noear:nacos-solon-cloud-plugin =3.0.0-rc3, =4.1.1 Source cves: CVE-2021-43116 Source advisory:...

cloud.kwrobot:xxl-job-core (2022.6.0), cn.aradin:aradin-alibaba-nacos-starter (>=0.0.3.1, <=0.0.4.beta2) +193 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (1.4.2)

com.alibaba.nacos:nacos-client MAVEN version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - cloud.kwrobot:xxl-job-core 2022.6.0 - cn.aradin:aradin-alibaba-nacos-starter =0.0.3.1, =0.0.3.1,...