PT-2019-4123 · Openssl+2 · Openssl+3

Rich Mirch · Publicado 2019-07-15 · Atualizado 2026-02-23 · CVE-2019-2390

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 4.0.11 MongoDB Server versions prior to 3.6.14 MongoDB Server versions prior to 3.4.22

Description The issue is related to insufficient access control in the MongoDB database management system. An unprivileged user or program on Microsoft Windows that can create OpenSSL configuration files in a fixed location may cause utility programs shipped with the MongoDB server to run attacker-defined code as the user running the utility.

Recommendations For MongoDB Server versions prior to 4.0.11, update to version 4.0.11 or later. For MongoDB Server versions prior to 3.6.14, update to version 3.6.14 or later. For MongoDB Server versions prior to 3.4.22, update to version 3.4.22 or later.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

CWE-264

Identificadores relacionados

BDU:2019-04702

CVE-2019-2390

Produtos afetados

Windows

Mongodb Server

Mongodb

Openssl

Referências · 8

• https://osv.dev/vulnerability/CVE-2019-2390 · Aviso do Fabricante
• https://t.me/cveNotify/152879 · Publicação no Telegram
• https://jira.mongodb.org/browse/SERVER-42233 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-04702 · Nota de Segurança
• https://t.me/cvenotify/68344 · Publicação no Telegram
• https://t.me/cvenotify/52641 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-2390 · Nota de Segurança
• https://cxsecurity.com/cveshow/CVE-2019-2390 · Nota