PT-2020-15201 · Alibaba · Nacos

Vi3It0R · Published 2020-09-30 · Updated 2021-08-02 · CVE-2020-19676

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nacos version 1.1.4

Description The issue is related to incorrect access control. It allows an environment to be set up locally to access the service details interface. Through the service list interface, other Nacos service names can be accessed. Furthermore, service details can be accessed even when not logged in.

Recommendations For Nacos version 1.1.4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-19676

GHSA-QF76-PR7X-H7R4

Affected Products

Nacos

References · 6

• 🔥 https://github.com/alibaba/nacos/issues/2284 · Exploit
• https://osv.dev/vulnerability/CVE-2020-19676 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qf76-pr7x-h7r4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-19676 · Security Note
• https://github.com/alibaba/nacos/issues/1105 · Note
• https://github.com/alibaba/nacos/releases/tag/1.2.0 · Note