Lucene search

[email protected]NVD:CVE-2022-24450

HistoryFeb 08, 2022 - 2:15 a.m.

CVE-2022-24450

2022-02-0802:15:06

CWE-862

[email protected]

web.nvd.nist.gov

nats server

access control

system account

dynamically provisioned sandbox accounts

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

36.9%

JSON

NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the “dynamically provisioned sandbox accounts” feature.

Affected configurations

Nvd

Node

natsnats_serverRange2.0.0–2.7.2

natsnats_streaming_serverRange0.15.0–0.24.1

VendorProductVersionCPE
natsnats_server*cpe:2.3:a:nats:nats_server:*:*:*:*:*:*:*:*
natsnats_streaming_server*cpe:2.3:a:nats:nats_streaming_server:*:*:*:*:*:*:*:*