Description

An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login.

Remediation

References

https://github.com/alibaba/nacos/issues/7182

https://github.com/alibaba/nacos/issues/7127

http://packetstormsecurity.com/files/171638/Nacos-2.0.3-Access-Control.html

Related Vulnerabilities

CVE-2023-36542 Vulnerability in maven package org.apache.nifi:nifi-dbcp-service

CVE-2022-25852 Vulnerability in npm package pg-native

CVE-2021-23900 Vulnerability in maven package com.mikesamuel:json-sanitizer

CVE-2018-1002204 Vulnerability in maven package org.webjars.npm:adm-zip

CVE-2020-7786 Vulnerability in npm package macfromip

Severity

Critical

Classification

CWE-287 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Issue Tracking Third Party Advisory