CVE-2021-29442
CVSS v3
7.5
HIGH
EPSS Score
94.0 %
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)
Technical details
- Published
- 2021-04-27
Frequently asked questions
What is CVE-2021-29442?
Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)
Is CVE-2021-29442 actively exploited?
Active exploitation of CVE-2021-29442 has not been confirmed. The EPSS score is 94.0%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2021-29442?
CVE-2021-29442 has a CVSS v3 base score of 7.5 (HIGH severity).
Is CVE-2021-29442 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2021 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).