Duplicate Advisory: Incorrect Access Control in github.com/nats-io/jwt and github.com/nats-io/nats-server/v2
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-62mh-w5cv-p88c (for github.com/nats-io/jwt) and GHSA-j756-f273-xhp4 (for github.com/nats-io/nats-server). This link is maintained to preserve external references. ## Original Description NATS Server (github.com/nats-io/nats-server/v2/server) 2.x before 2.2.0 and JWT library (github.com/nats-io/jwt/v2) before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-3127US | high7.5OT elevated | — | ||
NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled. | ||||
references
External citations — patches, advisories, analysis.
- https://advisories.nats.io/CVE/CVE-2021-3127.txtWEB
- https://github.com/nats-io/jwtPACKAGE
- https://github.com/nats-io/jwt/pull/149WEB
- https://github.com/nats-io/jwt/pull/149/commits/a826c77dc9d2671c961b75ceefdb439c41029866WEB
- https://github.com/nats-io/nats-server/commit/423b79440c80c863de9f4e20548504e6c5d5e403WEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-3127ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan