CVE-2022-26652

Sažetak

NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected.

Reference

http://www.openwall.com/lists/oss-security/2022/03/10/1
https://advisories.nats.io/CVE/CVE-2022-26652.txt
https://github.com/nats-io/nats-server/releases
https://github.com/nats-io/nats-server/security/advisories/GHSA-6h3m-36w8-hv68
http://www.openwall.com/lists/oss-security/2022/03/10/1
https://advisories.nats.io/CVE/CVE-2022-26652.txt
https://github.com/nats-io/nats-server/releases
https://github.com/nats-io/nats-server/security/advisories/GHSA-6h3m-36w8-hv68

CVSS

Base:	4.0
Impact:	2.9
Exploitability:	8.0

Pristup

Vektor	Složenost	Autentikacija
NETWORK	LOW	SINGLE

Impact

Povjerljivost	Cjelovitost	Dostupnost
NONE	PARTIAL	NONE

CVSS vektor

AV:N/AC:L/Au:S/C:N/I:P/A:N

Zadnje važnije ažuriranje

30-03-2026 - 14:30

Objavljeno

10-03-2022 - 17:47