SecuriTricks - CVE-2024-7553

Description

Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue

Product(s) Impacted

Product	Versions
MongoDB Server	['5.0 - 5.0.26', '6.0 - 6.0.15', '7.0 - 7.0.11', '7.3 - 7.3.2']
MongoDB C Driver	['before 1.26.2']
MongoDB PHP Driver	['before 1.18.1']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References

https://jira.mongodb.org/browse/CDRIVER-5650

https://jira.mongodb.org/browse/PHPC-2369

https://jira.mongodb.org/browse/SERVER-93211

CVSS Score

7.3 / 10

CVSS Data - 3.1

Attack Vector: LOCAL
Attack Complexity: LOW
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: HIGH
Availability Impact: HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

View Vector String

Timeline

Published: Aug. 7, 2024, 10:15 a.m.
Last Modified: Aug. 7, 2024, 3:17 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cna@mongodb.com

CVE-2024-7553