Vulnerability Details CVE-2022-26652
NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.009
EPSS Ranking 75.1%
CVSS Severity
CVSS v3 Score 6.5
CVSS v2 Score 4.0
References
- http://www.openwall.com/lists/oss-security/2022/03/10/1
- https://advisories.nats.io/CVE/CVE-2022-26652.txt
- https://github.com/nats-io/nats-server/releases
- https://github.com/nats-io/nats-server/security/advisories/GHSA-6h3m-36w8-hv68
- http://www.openwall.com/lists/oss-security/2022/03/10/1
- https://advisories.nats.io/CVE/CVE-2022-26652.txt
- https://github.com/nats-io/nats-server/releases
- https://github.com/nats-io/nats-server/security/advisories/GHSA-6h3m-36w8-hv68
Products affected by CVE-2022-26652
-
cpe:2.3:a:nats:nats_server:2.2.0
-
cpe:2.3:a:nats:nats_server:2.2.1
-
cpe:2.3:a:nats:nats_server:2.2.2
-
cpe:2.3:a:nats:nats_server:2.2.3
-
cpe:2.3:a:nats:nats_server:2.2.4
-
cpe:2.3:a:nats:nats_server:2.2.5
-
cpe:2.3:a:nats:nats_server:2.2.6
-
cpe:2.3:a:nats:nats_server:2.3.0
-
cpe:2.3:a:nats:nats_server:2.3.1
-
cpe:2.3:a:nats:nats_server:2.3.2
-
cpe:2.3:a:nats:nats_server:2.3.3
-
cpe:2.3:a:nats:nats_server:2.3.4
-
cpe:2.3:a:nats:nats_server:2.4.0
-
cpe:2.3:a:nats:nats_server:2.5.0
-
cpe:2.3:a:nats:nats_server:2.6.0
-
cpe:2.3:a:nats:nats_server:2.6.1
-
cpe:2.3:a:nats:nats_server:2.6.2
-
cpe:2.3:a:nats:nats_server:2.6.3
-
cpe:2.3:a:nats:nats_server:2.6.4
-
cpe:2.3:a:nats:nats_server:2.6.5
-
cpe:2.3:a:nats:nats_server:2.6.6
-
cpe:2.3:a:nats:nats_server:2.7.0
-
cpe:2.3:a:nats:nats_server:2.7.1
-
cpe:2.3:a:nats:nats_server:2.7.2
-
cpe:2.3:a:nats:nats_server:2.7.3
-
cpe:2.3:a:nats:nats_streaming_server:0.15.0
-
cpe:2.3:a:nats:nats_streaming_server:0.15.1
-
cpe:2.3:a:nats:nats_streaming_server:0.16.0
-
cpe:2.3:a:nats:nats_streaming_server:0.16.2
-
cpe:2.3:a:nats:nats_streaming_server:0.17.0
-
cpe:2.3:a:nats:nats_streaming_server:0.18.0
-
cpe:2.3:a:nats:nats_streaming_server:0.19.0
-
cpe:2.3:a:nats:nats_streaming_server:0.20.0
-
cpe:2.3:a:nats:nats_streaming_server:0.21.0
-
cpe:2.3:a:nats:nats_streaming_server:0.21.1
-
cpe:2.3:a:nats:nats_streaming_server:0.21.2
-
cpe:2.3:a:nats:nats_streaming_server:0.22.0
-
cpe:2.3:a:nats:nats_streaming_server:0.22.1
-
cpe:2.3:a:nats:nats_streaming_server:0.23.0
-
cpe:2.3:a:nats:nats_streaming_server:0.23.1
-
cpe:2.3:a:nats:nats_streaming_server:0.23.2
-
cpe:2.3:a:nats:nats_streaming_server:0.24.0
-
cpe:2.3:a:nats:nats_streaming_server:0.24.1
-
cpe:2.3:a:nats:nats_streaming_server:0.24.2