CVE-2021-3127

HIGH7.5EPSS 0.29%

nats-io/jwt not enforcing checking of Import token permissions

發布日:2022/2/15修改日:2026/4/28

描述

NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.

受影響套件(10)

Bitnami/nats>= 2.0.0, < 2.2.0
Debian/golang-github-nats-io-jwtfrom 0, < 2.2.0-1
Go/github.com/nats-io/jwtfrom 0, <= 1.2.2
Go/github.com/nats-io/jwtfrom 0, < 1.2.3-0.20210314221642-a826c77dc9d2
Go/github.com/nats-io/jwtfrom 0, < 1.2.3-0.20210314221642-a826c77dc9d2
Go/github.com/nats-io/jwt/v2from 0, < 2.0.1
Go/github.com/nats-io/jwt/v2from 0, < 2.0.1
Go/github.com/nats-io/jwt/v2from 0, < 2.0.1
Go/github.com/nats-io/nats-server/v2from 0, < 2.2.0
Go/github.com/nats-io/nats-server/v2from 0, < 2.2.0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

參考連結(11)