CVE-2022-24450

2022-02-0802:15:06

Debian Security Bug Tracker

security-tracker.debian.org

cve-2022-24450

nats server

access control

authentication

privileges

system account

sandbox accounts

unix

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

36.9%

JSON

NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the “dynamically provisioned sandbox accounts” feature.

OSVersionArchitecturePackageVersionFilename
Debian12allnats-server< 2.9.10-1nats-server_2.9.10-1_all.deb
Debian999allnats-server< 2.10.18-1nats-server_2.10.18-1_all.deb
Debian13allnats-server< 2.10.18-1nats-server_2.10.18-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	nats-server	< 2.9.10-1	nats-server_2.9.10-1_all.deb
Debian	999	all	nats-server	< 2.10.18-1	nats-server_2.10.18-1_all.deb
Debian	13	all	nats-server	< 2.10.18-1	nats-server_2.10.18-1_all.deb