CVE-2021-29441

CVE-2021-29441 affects Nacos before version 1.4.1. The AuthFilter used for enforcing authentication contains a backdoor that lets servers bypass the filter and skip authentication checks; the bypass relies on spoofable User-Agent headers, enabling a user to perform administrative tasks on the Nac...

CVE-2021-43116

CVE-2021-43116 affects Nacos 2.0.3 via an Access Control vulnerability in the login flow. According to the connected exploit material, an attacker can login by capturing authentication traffic and modifying the returned package after submitting credentials on the access prompt page, effectively b...

CVE-2021-29442

Nacos

CVE-2021-44667

CVE-2021-44667 is a Cross Site Scripting (XSS) vulnerability in Nacos 2.0.3 affecting the auth/users endpoint via the pageSize and pageNo parameters. The issue arises from insufficient input validation/filtering of user-supplied data, enabling attacker-controlled scripts to be executed in the vic...

CVE-2020-19676

CVE-2020-19676 affects Nacos 1.1.4 with an Incorrect Access Control flaw: an attacker can locally set up an environment to access the service details interface and, from there, access other service names via the service list interface without logging in. The impact is the exposure of service deta...