PT-2023-27262 · Mongodb · Mongodb Ops Manager
CVE-2023-4009
·
Publicado
2023-08-08
·
Atualizado
2023-08-31
CVSS v3.1
7.2
Alta
| Vetor | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
MongoDB Ops Manager versions 5.0 through 5.0.21
MongoDB Ops Manager versions 6.0 through 6.0.16
Description
The issue allows an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner, resulting in privilege escalation.
Recommendations
For MongoDB Ops Manager versions 5.0 through 5.0.21, update to version 5.0.22 or later.
For MongoDB Ops Manager versions 6.0 through 6.0.16, update to version 6.0.17 or later.
Correção
Improper Privilege Management
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Mongodb Ops Manager