BIT-nats-2022-24450

vendorUSosv

view advisory published 2024-03-06Licence: per source

NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-24450US	high8.8OT elevated	1.33% (71st)	—	2022-02-08
NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox…

references

External citations — patches, advisories, analysis.

https://advisories.nats.io/CVE/CVE-2022-24450.txtWEB
https://github.com/nats-io/nats-server/releases/tag/v2.7.2WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-24450WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan