PT-2023-27262 · Mongodb · Mongodb Ops Manager

Published 2023-08-08 · Updated 2023-08-31 · CVE-2023-4009

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MongoDB Ops Manager versions 5.0 through 5.0.21 MongoDB Ops Manager versions 6.0 through 6.0.16

Description The issue allows an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner, resulting in privilege escalation.

Recommendations For MongoDB Ops Manager versions 5.0 through 5.0.21, update to version 5.0.22 or later. For MongoDB Ops Manager versions 6.0 through 6.0.16, update to version 6.0.17 or later.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-648

CWE-269

Related Identifiers

CVE-2023-4009

Affected Products

Mongodb Ops Manager

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-4009 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4009 · Vendor Advisory
• https://mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-6-0 · Vendor Advisory
• https://mongodb.com/docs/ops-manager/v5.0/release-notes/application/#onprem-server-5-0-22 · Vendor Advisory
• https://twitter.com/cracbot/status/1689154635779780608 · Twitter Post
• https://security.netapp.com/advisory/ntap-20230831-0013 · Note
• https://t.me/cvenotify/56425 · Telegram Post
• https://t.me/cvenotify/55979 · Telegram Post