CVE-2023-47090

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-47090
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-47090.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-47090
Aliases
Downstream
Related
Published
2023-10-30T00:00:00Z
Modified
2026-07-08T06:27:18.105329106Z
Summary
[none]
Details

NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47090.json",
    "cna_assigner": "mitre"
}
References

Affected packages

Git / github.com/nats-io/nats-server

Affected ranges

Type
GIT
Repo
https://github.com/nats-io/nats-server
Events
Introduced
0e3c7230e4b7c85795592f74a62351f6fe22fcbd
Fixed
45436e1e5021106cebc9d76e6af0779c908b0f7a
Introduced
77e198333fb2b25029b620fae3574b328de37f89
Fixed
203c4b9c2d952e9bf05e1e5e825f55c3201a6128
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.2.0"
        },
        {
            "fixed": "2.9.23"
        },
        {
            "introduced": "2.10.0"
        },
        {
            "fixed": "2.10.2"
        }
    ]
}

Affected versions

v2.*
v2.10.0
v2.10.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.4.0
v2.5.0
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.6.6
v2.7.0
v2.7.0-rc1
v2.7.0-rc2
v2.7.1
v2.7.2
v2.7.3
v2.7.4
v2.8.0
v2.8.1
v2.8.2
v2.8.3
v2.8.4
v2.9.0
v2.9.1
v2.9.10
v2.9.11
v2.9.12
v2.9.14
v2.9.15
v2.9.16
v2.9.17
v2.9.18
v2.9.19
v2.9.2
v2.9.20
v2.9.21
v2.9.22
v2.9.3
v2.9.4
v2.9.5
v2.9.6
v2.9.7
v2.9.8
v2.9.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-47090.json"