PT-2023-16195 · Mongodb · Mongodb Ops Manager

Publicado 2023-06-09 · Atualizado 2023-06-30 · CVE-2023-0342

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MongoDB Ops Manager versions 5.0 through 5.0.20 MongoDB Ops Manager versions 6.0 through 6.0.11

Description The issue affects MongoDB Ops Manager Diagnostics Archive, where it may not redact sensitive PEM key file password app settings. However, the archives do not include the PEM files themselves.

Recommendations For MongoDB Ops Manager version 5.0, update to version 5.0.21 or later. For MongoDB Ops Manager version 6.0, update to version 6.0.12 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-497

Identificadores relacionados

CVE-2023-0342

Produtos afetados

Mongodb Ops Manager

Referências · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/mongodb_ops_manager_diagnostic_archive_info.rb · Exploit
• https://mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-6-0-12 · Nota
• https://t.me/cvenotify/52764 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-0342 · Nota de Segurança
• https://t.me/cvenotify/53385 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-0342 · Aviso do Fabricante
• https://mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-5-0-21 · Nota