GHSA-4gr7-qw2q-jxh6

Cross-site Scripting in Nacos

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-44667

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.alibaba.nacos:nacos-common	>= 2.0.0-ALPHA.1, < 2.1.0-BETA	2.1.0-BETA
Maven	com.alibaba.nacos:nacos-common	< 1.4.5	1.4.5

Details

As written in the advisory (Markdown source, shown as plain text).

A Cross Site Scripting (XSS) vulnerability exists in Nacos prior to 1.4.5 and 2.1.0-BETA in auth/users via the (1) pageSize and (2) pageNo parameters.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-44667 advisory
https://github.com/alibaba/nacos/issues/7359 web
https://github.com/alibaba/nacos/pull/7364 web
https://github.com/alibaba/nacos/pull/8980 web
https://github.com/alibaba/nacos/commit/cd6d7e33b94f24814701f3faf8b632e5e85444c5 web
https://github.com/alibaba/nacos/commit/d062fcafad0acd01673d404319526415a4af372b web
https://github.com/alibaba/nacos package