CVE-2023-39106: High severity nacos vulnerability
Published Aug 21, 2023
·Updated
An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor() component.
Affected Software
2 affected components
maven/com.alibaba.nacos:nacos-spring-context<=1.1.1
Alibabacloud Nacos Spring Project<=1.1.1
Event History
Aug 21, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Advisory Published
06:31 PM
Frequently Asked Questions
1
What is the severity of CVE-2023-39106?
CVE-2023-39106 is considered to have a high severity due to its potential for remote code execution.
2
How do I fix CVE-2023-39106?
To fix CVE-2023-39106, upgrade to Nacos Spring Project version 1.1.2 or later.
3
Which versions are affected by CVE-2023-39106?
CVE-2023-39106 affects Nacos Spring Project versions 1.1.1 and earlier.
4
What type of vulnerability is CVE-2023-39106?
CVE-2023-39106 is a remote code execution vulnerability.
5
Can CVE-2023-39106 impact my application?
Yes, if your application is using affected versions of Nacos Spring Project, it can be exploited by a remote attacker.