CVE-2021-29441

Katalog CVE

CVSS 9.8 · Critical EPSS 83,5%

Kerentanan Authentication Bypass by Spoofing pada alibaba nacos. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.

Rincian

Terbit di NVD

27 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

83,5% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/alibaba/nacos/pull/4703 patch · advisory pihak ketiga
• https://github.com/advisories/GHSA-36hp-jr8h-556f exploit · advisory pihak ketiga
• https://github.com/alibaba/nacos/issues/4701 exploit · advisory pihak ketiga