CyberRota Analysis
AI-GeneratedAuthenticated users of NATS Server prior to versions 2.14.0, 2.12.7, and 2.11.16 can exploit a vulnerability that allows them to bypass subscription deny permissions through queue subscriptions. This could lead to unauthorized access to sensitive messaging data, potentially compromising the integrity of the messaging system. Organizations using affected versions should prioritize upgrading to the patched releases to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user with subscription deny permissions could bypass a plain subject deny rule by using a queue subscription, because queue-specific deny evaluation could override the plain subject deny result when the queue name itself was not denied. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.
Related CVEs
Other vulnerabilities affecting the same vendor(s)