{"id":"CVE-2021-44667","aliases":["GHSA-4gr7-qw2q-jxh6"],"url":"https://o3.security/vulnerability/CVE-2021-44667","summary":"Cross-site Scripting in Nacos","details":"A Cross Site Scripting (XSS) vulnerability exists in Nacos prior to 1.4.5 and 2.1.0-BETA in auth/users via the (1) pageSize and (2) pageNo parameters.","published":"2022-03-11T19:15:09.023Z","modified":"2026-07-08T23:58:27.123551Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Maven","name":"com.alibaba.nacos:nacos-common","fixedVersion":"2.1.0-BETA"},{"ecosystem":"Maven","name":"com.alibaba.nacos:nacos-common","fixedVersion":"1.4.5"}],"fix":{"url":"https://github.com/alibaba/nacos/pull/7364","label":"alibaba/nacos#7364"},"references":[{"type":"REPORT","url":"https://github.com/alibaba/nacos/issues/7359"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44667"},{"type":"WEB","url":"https://github.com/alibaba/nacos/pull/7364"},{"type":"WEB","url":"https://github.com/alibaba/nacos/pull/8980"},{"type":"WEB","url":"https://github.com/alibaba/nacos/commit/cd6d7e33b94f24814701f3faf8b632e5e85444c5"},{"type":"WEB","url":"https://github.com/alibaba/nacos/commit/d062fcafad0acd01673d404319526415a4af372b"},{"type":"PACKAGE","url":"https://github.com/alibaba/nacos"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T23:58:27.123551Z"}}