CVE-2022-24450

Published: Feb 8, 2022Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature.

Affected (2)

Products: Linuxfoundation: Nats Server · Nats: Nats Streaming Server

Linuxfoundation

1 product

Nats Server

Nats

1 product

Nats Streaming Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Linuxfoundation Nats Server	From 2.0.0 to 2.7.2
Nats Nats Streaming Server	From 0.15.0 to 0.24.1

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (4)

https://advisories.nats.io/CVE/CVE-2022-24450.txt

Source: cve@mitre.org

Vendor Advisory

https://github.com/nats-io/nats-server/releases/tag/v2.7.2

Source: cve@mitre.org

Release NotesThird Party Advisory

https://advisories.nats.io/CVE/CVE-2022-24450.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://github.com/nats-io/nats-server/releases/tag/v2.7.2

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

Timeline

No history available yet.