CVE-2021-43116 EXPLOIT
8.8
HIGH · CVSS 3.1 · EPSS 7.5% (pctl 94)
Patch early
A public exploit exists.
Description
An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login.
Scoring
| CVSS | 8.8 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 7.46% — more likely to be exploited than 94% of all CVEs |
| Weakness | CWE-287 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2022-07-05 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| alibaba | nacos |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Nacos 2.0.3 - Access Control vulnerability | 2023-04-03 |
References
- http://packetstormsecurity.com/files/171638/Nacos-2.0.3-Access-Control.html
- https://github.com/alibaba/nacos/issues/7127
- https://github.com/alibaba/nacos/issues/7182
- http://packetstormsecurity.com/files/171638/Nacos-2.0.3-Access-Control.html
- https://github.com/alibaba/nacos/issues/7127
- https://github.com/alibaba/nacos/issues/7182
→ the Explorer · watch your stack · NVD