PT-2019-16409 · Mongodb+1 · Mongodb Server+2

Sicheng Liu · Publicado 2019-08-30 · Atualizado 2024-01-23 · CVE-2019-2389

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 4.0.11 MongoDB Server versions prior to 3.6.14 MongoDB Server versions prior to 3.4.22

Description The issue is related to incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts. This allows users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init.

Recommendations For MongoDB Server versions prior to 4.0.11, update to version 4.0.11 or later. For MongoDB Server versions prior to 3.6.14, update to version 3.6.14 or later. For MongoDB Server versions prior to 3.4.22, update to version 3.4.22 or later.

Correção

Incorrect Permission

RCE

Enumeração de Fraquezas

CWE-732

CWE-20

Identificadores relacionados

ALT-PU-2022-3039

CVE-2019-2389

Produtos afetados

Alt Linux

Mongodb Server

Mongodb

Referências · 25

• https://t.me/cvenotify/52640 · Publicação no Telegram
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20330 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20804 · Nota de Segurança
• https://bdu.fstec.ru/vul/2020-03363 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2386 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2392 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-2389 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2389 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20925 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2019-2389 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7923 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7921 · Nota de Segurança
• https://t.me/cvenotify/68343 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2021-03388 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7929 · Nota de Segurança