CVE-2020-19676: 
Java vulnerability analysis and mitigation

Nacos 1.1.4 is affected by an Incorrect Access Control vulnerability (CVE-2020-19676). The vulnerability was discovered and disclosed in August 2020, allowing unauthorized access to service details through the service list interface without requiring authentication. The vulnerability specifically affects the Alibaba Nacos service management platform (NVD, MITRE).

The vulnerability has a CVSS v3.1 Base Score of 5.3 (MEDIUM) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The issue stems from improper access control implementation where an environment can be set up locally to access the service details interface. Through this vulnerability, attackers can access other Nacos service names via the service list interface and subsequently retrieve service details without authentication (NVD).

The vulnerability allows unauthorized access to service details, potentially exposing sensitive service configuration information. The impact is primarily focused on confidentiality, with no direct impact on integrity or availability of the system (NVD).

The vulnerability is easily exploitable and requires no authentication. An attacker can set up a local environment to access the service details interface and subsequently access other Nacos service names through the service list interface without being logged in (Github Issue).