CVE-2022-28357

2023-09-1902:15:54

Debian Security Bug Tracker

security-tracker.debian.org

cve-2022-28357

nats server

directory traversal

management account

unix

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

52.0%

JSON

NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account.

OSVersionArchitecturePackageVersionFilename
Debian12allnats-server< 2.9.10-1nats-server_2.9.10-1_all.deb
Debian999allnats-server< 2.10.18-1nats-server_2.10.18-1_all.deb
Debian13allnats-server< 2.10.18-1nats-server_2.10.18-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	nats-server	< 2.9.10-1	nats-server_2.9.10-1_all.deb
Debian	999	all	nats-server	< 2.10.18-1	nats-server_2.10.18-1_all.deb
Debian	13	all	nats-server	< 2.10.18-1	nats-server_2.10.18-1_all.deb