CVEvulnerability
CVE-2023-47090
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-10-30
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-863
Description
NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.
Affected configurations
• linuxfoundation nats-server (>= 2.2.0 < 2.9.23)
• linuxfoundation nats-server (>= 2.10.0 < 2.10.2)
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- http://www.openwall.com/lists/oss-security/2023/10/30/1 Mailing List
- https://github.com/nats-io/nats-server/security/advisories/GHSA-fr2g-9hjm-wr23 Vendor Advisory
- https://www.openwall.com/lists/oss-security/2023/10/13/2 Mailing List, Mitigation
- http://www.openwall.com/lists/oss-security/2023/10/30/1 Mailing List
- https://github.com/nats-io/nats-server/security/advisories/GHSA-fr2g-9hjm-wr23 Vendor Advisory
- https://www.openwall.com/lists/oss-security/2023/10/13/2 Mailing List, Mitigation