x/vulndb: potential Go vuln in github.com/nats-io/nats-server: CVE-2022-28357

[GoVulnBot]

CVE-2022-28357 references github.com/nats-io/nats-server, which may be a Go module.

Description:
NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2022-28357
• JSON: https://github.com/CVEProject/cvelist/tree/2cb761c7b6671660e82d615bbbe6cdb42dd9b0cd/2022/28xxx/CVE-2022-28357.json
• web: https://github.com/nats-io/nats-server/releases
• web: https://advisories.nats.io/CVE/CVE-2022-28357.txt
• Imported by: https://pkg.go.dev/github.com/nats-io/nats-server?tab=importedby

Cross references:

• Module github.com/nats-io/nats-server appears in issue x/vulndb: potential Go vuln in github.com/nats-io/nats-server: CVE-2022-24450 #307 EFFECTIVELY_PRIVATE
• Module github.com/nats-io/nats-server appears in issue x/vulndb: potential Go vuln in github.com/nats-io/nats-server: CVE-2022-26652 #351 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/nats-io/nats-server
      vulnerable_at: 1.4.1
      packages:
        - package: n/a
description: |-
    NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an
    unintended path to a management action from a management account.
cves:
    - CVE-2022-28357
references:
    - web: https://github.com/nats-io/nats-server/releases
    - web: https://advisories.nats.io/CVE/CVE-2022-28357.txt

[gopherbot]

Change https://go.dev/cl/529258 mentions this issue: data/excluded: batch add 1 excluded reports

[gopherbot]

Change https://go.dev/cl/592763 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606791 mentions this issue: data/reports: unexclude 20 reports (11)