Cross-site Scripting (XSS)

2022-03-1402:52:10

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

nacos-console

xss

vulnerability

consoleconfig.java

injection

javascript

EPSS

0.001

Percentile

34.0%

JSON

nacos-console is vulnerable to cross-site scripting. The vulnerability exists because the library does not set the xssFilter option in the ConsoleConfig.java, allowing an attacker to inject and execute malicious javascript through the pageSize and pageNo parameters.