Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server (MongoDB Inc MongoDB Server)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.43 % · percentile 37 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mongodb
- NVD status
- Modified
Description
"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versions prior to 7.3.3
Weaknesses (CWE)
- CWE-285 — Improper Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N | mongodb |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · cna@mongodb.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-47491
- GCVE · GCVE-0-2024-6384
CERT-FR advisories
- CERTFR-2024-AVI-0705 — Vulnérabilité dans MongoDB · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:mongodb:mongodb:*:*:*:*:enterprise:*:*:*≥ 6.0.0 < 6.0.16cpe:2.3:a:mongodb:mongodb:*:*:*:*:enterprise:*:*:*≥ 7.0.0 < 7.0.11cpe:2.3:a:mongodb:mongodb:*:*:*:*:enterprise:*:*:*≥ 7.3.0 < 7.3.3
Affected products
| Product | Versions |
|---|---|
| MongoDB Inc · MongoDB Server | affected 6.0 < 6.0.16 ; affected 7.0 < 7.0.11 ; affected 7.3 < 7.3.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |