Improper Authorization

🗓️ 23 Apr 2025 14:04:55Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 3 Views

Improper Authorization in NATS server allows unauthorized actions via JetStream management API requests.

Reporter	Title	Published	Views	Family All 38
IBM Security Bulletins	Security Bulletin: A flaw was found in NATS-SERVER which affect IBM watsonx.data	16 Jul 202505:55	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to API abuse due to the NATS-Server package (CVE-2025-30215)	11 Aug 202522:06	–	ibm
AlpineLinux	CVE-2025-30215	15 Apr 202523:25	–	alpinelinux
Tenable Nessus	Azure Linux 3.0 Security Update: telegraf (CVE-2025-30215)	23 Apr 202500:00	–	nessus
Tenable Nessus	CBL Mariner 2.0 Security Update: telegraf (CVE-2025-30215)	23 Apr 202500:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2025-30215	21 Aug 202500:00	–	nessus
CBLMariner	CVE-2025-30215 affecting package telegraf for versions less than 1.29.4-15	22 Apr 202521:14	–	cbl_mariner
CBLMariner	CVE-2025-30215 affecting package telegraf for versions less than 1.31.0-9	22 Apr 202515:08	–	cbl_mariner
Chainguard	CVE-2025-30215 vulnerabilities	16 Apr 202513:13	–	cgr
Circl	CVE-2025-30215	8 Apr 202521:24	–	circl

Vulners

Node

linuxfoundation nats-serverMatch2.10.25-r0go

AND

linuxfoundation nats-serverMatch2.10.14-r0go

AND

linuxfoundation nats-serverMatch2.9.17-r0go

AND

linuxfoundation nats-serverMatch2.9.0-r0go

AND

linuxfoundation nats-serverMatch2.10.7-r0go

AND

linuxfoundation nats-serverMatch2.9.14-r1go

AND

linuxfoundation nats-serverMatch2.9.20-r0go

AND

linuxfoundation nats-serverMatch2.9.22-r0go

AND

linuxfoundation nats-serverMatch2.8.4-r2go

AND

linuxfoundation nats-serverMatch2.10.26-r0go

AND

linuxfoundation nats-serverMatch2.10.10-r0go

AND

linuxfoundation nats-serverMatch2.10.12-r1go

AND

linuxfoundation nats-serverMatch2.10.26-r2go

AND

linuxfoundation nats-serverMatch2.9.21-r1go

AND

linuxfoundation nats-serverMatch2.9.6-r0go

AND

linuxfoundation nats-serverMatch2.10.2-r0go

AND

linuxfoundation nats-serverMatch2.9.14-r0go

AND

linuxfoundation nats-serverMatch2.9.16-r2go

AND

linuxfoundation nats-serverMatch2.10.26-r1go

AND

linuxfoundation nats-serverMatch2.10.17-r0go

AND

linuxfoundation nats-serverMatch2.9.19-r0go

AND

linuxfoundation nats-serverMatch2.10.17-r1go

AND

linuxfoundation nats-serverMatch2.9.21-r0go

AND

linuxfoundation nats-serverMatch2.9.15-r1go

AND

linuxfoundation nats-serverMatch2.10.1-r0go

AND

linuxfoundation nats-serverMatch2.10.18-r0go

AND

linuxfoundation nats-serverMatch2.10.14-r1go

AND

linuxfoundation nats-serverMatch2.9.8-r0go

AND

linuxfoundation nats-serverMatch2.10.12-r0go

AND

linuxfoundation nats-serverMatch2.9.18-r0go

AND

linuxfoundation nats-serverMatch2.9.16-r1go

AND

linuxfoundation nats-serverMatch2.9.4-r0go

AND

linuxfoundation nats-serverMatch2.8.4-r1go

AND

linuxfoundation nats-serverMatch2.9.10-r0go

AND

linuxfoundation nats-serverMatch2.10.11-r0go

AND

linuxfoundation nats-serverMatch2.9.7-r0go

AND

linuxfoundation nats-serverMatch2.10.20-r0go

AND

linuxfoundation nats-serverMatch2.9.2-r0go

AND

linuxfoundation nats-serverMatch2.9.15-r0go

AND

linuxfoundation nats-serverMatch2.10.16-r0go

AND

linuxfoundation nats-serverMatch2.10.16-r1go

AND

linuxfoundation nats-serverMatch2.9.11-r0go

AND

linuxfoundation nats-serverMatch2.9.19-r1go

AND

linuxfoundation nats-serverMatch2.10.3-r0go

AND

linuxfoundation nats-serverMatch2.9.8-r1go

AND

linuxfoundation nats-serverMatch2.10.21-r0go

AND

linuxfoundation nats-serverMatch2.10.23-r1go

AND

linuxfoundation nats-serverMatch2.8.4-r0go

AND

linuxfoundation nats-serverMatch2.9.2-r2go

AND

linuxfoundation nats-serverMatch2.10.23-r0go

AND

linuxfoundation nats-serverMatch2.9.1-r0go

AND

linuxfoundation nats-serverMatch2.9.3-r0go

AND

linuxfoundation nats-serverMatch2.10.4-r0go

AND

linuxfoundation nats-serverMatch2.10.25-r1go

AND

linuxfoundation nats-serverMatch2.9.12-r0go

AND

alpinelinux alpine_linuxMatchedge

linuxfoundation nats-serverMatch2.10.21-r3go

AND

linuxfoundation nats-serverMatch2.10.21-r4go

AND

linuxfoundation nats-serverMatch2.10.21-r1go

AND

linuxfoundation nats-serverMatch2.10.21-r0go

AND

linuxfoundation nats-serverMatch2.10.21-r2go

AND

alpinelinux alpine_linuxMatch3.21

nats-io github.com/nats-io/nats-serverRangev2.11.0-RC.1–2.11.0-RC.1go

nats-io github.com/nats-io/nats-serverRangev2.2.0–2.2.0go

Source	Link
advisories	www.advisories.nats.io/CVE/secnote-2025-01.txt
openwall	www.openwall.com/lists/oss-security/2025/04/08/5
github	www.github.com/nats-io/nats-server/commit/406f83666cc5e6ec1259684b2f883b2e30ffa147
github	www.github.com/advisories/GHSA-fhg8-qxh5-7q3w
github	www.github.com/nats-io/nats-server/security/advisories/GHSA-fhg8-qxh5-7q3w
github	www.github.com/nats-io/nats-server/security/advisories/GHSA-fhg8-qxh5-7q3w
openwall	www.openwall.com/lists/oss-security/2025/04/08/5

23 Apr 2025 18:14Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.19.6

EPSS0.00029

SSVC