CVE-2021-21501: Path traversal in ServiceCenter
Summary
CVE-2021-21501: Path traversal in ServiceCenter. Affects github.com/apache/servicecomb-service-center versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ServiceComb ServiceCenter is a package written in Go that provides service registration and discovery capabilities. It is used to manage microservices in a distributed system. The vulnerability identified as CVE-2021-21501 is a path traversal issue in ServiceCenter versions 1.x.x. This vulnerability allows an attacker to access files outside of the intended directory, potentially leading to unauthorized access or information disclosure.
Vulnerability Detail
The vulnerability arises due to improper configuration in ServiceCenter. By exploiting this vulnerability, an attacker can traverse the directory structure and access files that should be restricted. This can result in the exposure of sensitive information or the execution of arbitrary code. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.0.0
This is the first release that contains the fix.
go get github.com/apache/servicecomb-service-center@v2.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is advised to upgrade to the fixed version as soon as possible.
Conclusion
The path traversal vulnerability in ServiceCenter can be mitigated by upgrading to version 2.0.0 or later. It is crucial to promptly address this vulnerability to prevent unauthorized access and information disclosure. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/apache/servicecomb-service-center →
FAQ
ServiceComb ServiceCenter is a Go package used for service registration and discovery in distributed systems.
The vulnerability allows an attacker to access files outside of the intended directory, potentially leading to unauthorized access or information disclosure.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, upgrade to ServiceCenter version 2.0.0 or later.
No specific workaround is available. It is recommended to upgrade to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/apache/servicecomb-service-center.
