Back

CVE-2024-8207

Aug. 27, 2024, 1:01 p.m.

Awaiting Analysis
CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

Products

MongoDB Server

  • 5.0.0 - 5.0.13
  • 6.0.0 - 6.0.2

Source

cna@mongodb.com

Tags

cna@mongodb.com
CWE-114
2024-08-27
CVE-2024-8207

CVE-2024-8207 details

Published : Aug. 27, 2024, 12:15 p.m.
Last Modified : Aug. 27, 2024, 1:01 p.m.

Description

In certain highly specific configurations of the host system and MongoDB server binary installation on Linux Operating Systems, it may be possible for a unintended actor with host-level access to cause the MongoDB Server binary to load unintended actor-controlled shared libraries when the server binary is started, potentially resulting in the unintended actor gaining full control over the MongoDB server process. This issue affects MongoDB Server v5.0 versions prior to 5.0.14 and MongoDB Server v6.0 versions prior to 6.0.3. Required Configuration: Only environments with Linux as the underlying operating system is affected by this issue

CVSS Score

1 2 3 4 5 6.4 7 8 9 10

Weakness

Weakness Name Description
CWE-114 Process Control Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.

CVSS Data

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

6.4

Exploitability Score

0.5

Impact Score

5.9

Base Severity

MEDIUM

Vector String : CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References

URL Source
https://jira.mongodb.org/browse/SERVER-69507 cna@mongodb.com
This website uses the NVD API, but is not approved or certified by it.