Description
An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor() component.
Remediation
References
https://github.com/nacos-group/nacos-spring-project/issues/314
Related Vulnerabilities
CVE-2019-20364 Vulnerability in maven package org.igniterealtime.openfire:xmppserver
CVE-2021-32769 Vulnerability in maven package io.micronaut:micronaut-core
CVE-2015-8315 Vulnerability in npm package ms
CVE-2022-35923 Vulnerability in npm package v8n
CVE-2020-28168 Vulnerability in maven package org.webjars.npm:axios