medium6.1
CVE-2021-44667
Cross-site Scripting in Nacos
Impact
A Cross Site Scripting (XSS) vulnerability exists in Nacos prior to 1.4.5 and 2.1.0-BETA in auth/users via the (1) pageSize and (2) pageNo parameters.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.alibaba.nacos:nacos-common | >= 2.0.0-ALPHA.1, < 2.1.0-BETA | 2.1.0-BETA |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Alibaba | Nacos | Version 2.0.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/alibaba/nacos/issues/7359
- https://github.com/advisories/GHSA-4gr7-qw2q-jxh6
- https://nvd.nist.gov/vuln/detail/CVE-2021-44667
- https://github.com/alibaba/nacos/commit/cd6d7e33b94f24814701f3faf8b632e5e85444c5
- https://github.com/alibaba/nacos/pull/7364
- https://github.com/alibaba/nacos/pull/8980
- https://github.com/alibaba/nacos/commit/d062fcafad0acd01673d404319526415a4af372b