PT-2019-16408 · Mongodb+3 · Mongodb Server+4

Mitch Wasson · Published 2019-08-06 · Updated 2026-02-23 · CVE-2019-2386

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 4.0.9 MongoDB Server versions prior to 3.6.13 MongoDB Server versions prior to 3.4.22

Description The improper invalidation of authorization sessions in MongoDB Server allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones.

Recommendations For MongoDB Server versions prior to 4.0.9, restart any nodes which may have had active user authorization sessions after deleting one or more users, and refrain from creating user accounts with the same name as previously deleted accounts. For MongoDB Server versions prior to 3.6.13, restart any nodes which may have had active user authorization sessions after deleting one or more users, and refrain from creating user accounts with the same name as previously deleted accounts. For MongoDB Server versions prior to 3.4.22, restart any nodes which may have had active user authorization sessions after deleting one or more users, and refrain from creating user accounts with the same name as previously deleted accounts.

Exploit

Fix

Insufficient Session Expiration

Improper Authorization

Weakness Enumeration

CWE-613

CWE-285

Related Identifiers

ALT-PU-2022-3039

CVE-2019-2386

USN-5052-1

Affected Products

Alt Linux

Linuxmint

Mongodb Server

Mongodb

Ubuntu

References · 11

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0829 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-2386 · Vendor Advisory
• https://jira.mongodb.org/browse/SERVER-38984 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5052-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-2386 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-2386 · Security Note
• https://osv.dev/vulnerability/USN-5052-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-2386 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-2386 · Security Note
• https://t.me/cvenotify/68342 · Telegram Post
• https://t.me/cveNotify/152878 · Telegram Post