PT-2023-16195 · Mongodb · Mongodb Ops Manager

Published 2023-06-09 · Updated 2023-06-30 · CVE-2023-0342

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MongoDB Ops Manager versions 5.0 through 5.0.20 MongoDB Ops Manager versions 6.0 through 6.0.11

Description The issue affects MongoDB Ops Manager Diagnostics Archive, where it may not redact sensitive PEM key file password app settings. However, the archives do not include the PEM files themselves.

Recommendations For MongoDB Ops Manager version 5.0, update to version 5.0.21 or later. For MongoDB Ops Manager version 6.0, update to version 6.0.12 or later.

Exploit

Fix

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2023-0342

Affected Products

Mongodb Ops Manager

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/mongodb_ops_manager_diagnostic_archive_info.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-0342 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0342 · Vendor Advisory
• https://mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-6-0-12 · Note
• https://t.me/cvenotify/52764 · Telegram Post
• https://t.me/cvenotify/53385 · Telegram Post
• https://mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-5-0-21 · Note