Vulnerability

CVE-2022-24450

 Report advisory or correction

CVSS Score 8.8 high

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-862

References

https://github.com/nats-io/nats-server/releases/tag/v2.7.2
https://advisories.nats.io/CVE/CVE-2022-24450.txt
https://github.com/nats-io/nats-server/security/advisories/GHSA-g6w6-r76c-28j7
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24450

[CVE-2022-24450] CWE-862: Missing Authorization

Description

NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature.

Deviation Notice:
Sonatype's research suggests that this CVE's details differ from those defined at NVD or other reporting sources; sign in for details.

Sign up and see:

Detailed deviation notices:
  • Detailed deviations
  • References
  • Custom Descriptions [Coming Soon]
Sign Up
See github.com/nats-io/nats-server/v2 package information