Insufficiently Protected Credentials
CVE-2020-26149
Summary
NATS nats.js from 2.0.0-201 up to 2.0.0-206, nats.ws from 1.0.0-85 up to 1.0.0-110, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server.
- LOW
- NETWORK
- NONE
- UNCHANGED
- NONE
- NONE
- HIGH
- NONE
CWE-522 - Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Advisory Timeline
- Published