How severe is CVE-2020-19676?

CVE-2020-19676 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2020-19676 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (70th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-19676?

CVE-2020-19676 affects Alibaba Nacos. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-19676?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-19676 published?

CVE-2020-19676 was published on 2020-09-30 and last updated on 2026-06-17.

CVE-2020-19676

CVE-2020-19676 is a medium-severity vulnerability in Alibaba Nacos with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v2: 5.0
EPSS exploit prediction: 1% (70th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Alibaba Nacos
Published: 2020-09-30
Last modified: 2026-06-17

Description

Nacos 1.1.4 is affected by: Incorrect Access Control. An environment can be set up locally to get the service details interface. Then other Nacos service names can be accessed through the service list interface. Service details can then be accessed when not logged in. (detail:https://github.com/alibaba/nacos/issues/2284)

Frequently asked questions

What is CVE-2020-19676?: Nacos 1.1.4 is affected by: Incorrect Access Control. An environment can be set up locally to get the service details interface. Then other Nacos service names can be accessed through the service list interface. Service details can then be accessed when not logged in. (detail:https://github.com/alibaba/nacos/issues/2284)
How severe is CVE-2020-19676?: CVE-2020-19676 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2020-19676 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (70th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-19676?: CVE-2020-19676 affects Alibaba Nacos. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-19676?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-19676 published?: CVE-2020-19676 was published on 2020-09-30 and last updated on 2026-06-17.

References

https://github.com/alibaba/nacos/issues/2284

Affected products (1)

cpe:2.3:a:alibaba:nacos:1.1.4:*:*:*:*:*:*:*

More vulnerabilities in Alibaba Nacos

CVE-2021-43116 — High (CVSS 8.8): An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on…
CVE-2021-29442 — High (CVSS 8.6): Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before…
CVE-2021-29441 — High (CVSS 8.6): Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before…
CVE-2021-44667 — Medium (CVSS 6.1): A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo…

All CVEs affecting Alibaba Nacos →