CVE-2021-29442

Katalog CVE

CVSS 7.5 · High EPSS 65,7%

Kerentanan Missing Authentication for Critical Function pada alibaba nacos. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)

Rincian

Terbit di NVD

27 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

65,7% peluang dieksploitasi; lebih tinggi dari 99,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/alibaba/nacos/pull/4517 patch · advisory pihak ketiga
• https://github.com/advisories/GHSA-36hp-jr8h-556f exploit · advisory pihak ketiga
• https://github.com/alibaba/nacos/issues/4463 exploit · advisory pihak ketiga