Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server (MongoDB Inc MongoDB Server)
En bref
- Source
- NVD
- EPSS
- EPSS 0.43 % · centile 37 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mongodb
- Statut NVD
- Modified
Description
"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versions prior to 7.3.3
Faiblesses (CWE)
- CWE-285 — Autorisation incorrecte
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N | mongodb |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · cna@mongodb.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2024-47491
- GCVE · GCVE-0-2024-6384
Avis du CERT-FR
- CERTFR-2024-AVI-0705 — Vulnérabilité dans MongoDB · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:mongodb:mongodb:*:*:*:*:enterprise:*:*:*≥ 6.0.0 < 6.0.16cpe:2.3:a:mongodb:mongodb:*:*:*:*:enterprise:*:*:*≥ 7.0.0 < 7.0.11cpe:2.3:a:mongodb:mongodb:*:*:*:*:enterprise:*:*:*≥ 7.3.0 < 7.3.3
Produits affectés
| Produit | Versions |
|---|---|
| MongoDB Inc · MongoDB Server | affected 6.0 < 6.0.16 ; affected 7.0 < 7.0.11 ; affected 7.3 < 7.3.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |