PT-2025-15666 · Unknown+1 · Nats Server+1

Zarqman · Published 2025-01-01 · Updated 2025-04-22 · CVE-2025-30215

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions NATS-Server versions 2.2.0 through 2.10.27 NATS-Server versions prior to 2.11.1

Description The issue is related to the absence of access controls for the JetStream API in NATS-Server, allowing any user with JS management permissions in any account to perform certain administrative actions on any JS asset in any other account. At least one of the unprotected APIs allows for data destruction. None of the affected APIs allow disclosing stream contents.

Recommendations For versions 2.2.0 through 2.10.27, update to version 2.10.27 or later. For versions prior to 2.11.1, update to version 2.11.1 or later. As a temporary workaround, consider restricting access to the JetStream API to minimize the risk of exploitation.

Exploit

Fix

LPE

Improper Authorization

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-285

CWE-287

CWE-306

CWE-648

Related Identifiers

AZL-60399

AZL-60406

BDU:2025-04232

BIT-NATS-2025-30215

CVE-2025-30215

GHSA-FHG8-QXH5-7Q3W

GO-2025-3600

OPENSUSE-SU-2025:15014-1

Affected Products

Debian

Nats Server

References · 29

• 🔥 https://github.com/nats-io/nats-server/security/advisories/GHSA-fhg8-qxh5-7q3w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30215.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-30215 · Security Note
• https://osv.dev/vulnerability/GO-2025-3600 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04232 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30215 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fhg8-qxh5-7q3w · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-30215 · Security Note
• https://osv.dev/vulnerability/AZL-60399 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-60406 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-30215 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-30215 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nats-2025-30215 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-30215 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-30215 · Vendor Advisory