Description
Nacos 1.1.4 is affected by: Incorrect Access Control. An environment can be set up locally to get the service details interface. Then other Nacos service names can be accessed through the service list interface. Service details can then be accessed when not logged in. (detail:https://github.com/alibaba/nacos/issues/2284)
Remediation
References
https://github.com/alibaba/nacos/issues/2284
Related Vulnerabilities
CVE-2021-3137 Vulnerability in maven package org.xwiki.commons:xwiki-commons
CVE-2017-16196 Vulnerability in npm package quickserver
CVE-2021-21345 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2022-41713 Vulnerability in maven package org.webjars.npm:deep-object-diff
CVE-2018-14042 Vulnerability in maven package org.webjars.bower:bootstrap