HIGH

CVE-2021-29442

CVSS v3

7.5

HIGH

EPSS Score

94.0%

exploit probability

CISA KEV

No

known exploited

Exploitation

SSVC status

Description

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)

Technical details

Published
4/27/2021

Frequently asked questions

What is CVE-2021-29442?

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)

Is CVE-2021-29442 actively exploited?

Active exploitation of CVE-2021-29442 has not been confirmed. The EPSS score is 94.0%, indicating the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2021-29442?

CVE-2021-29442 has a CVSS v3 base score of 7.5 (HIGH severity).

Is CVE-2021-29442 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.