Summaryinfo

A vulnerability described as critical has been identified in MongoDB up to 3.4.21/3.6.13/4.0.10 on Windows. This vulnerability affects unknown code of the component OpenSSL. Such manipulation as part of Configuration File leads to access control. This vulnerability is listed as CVE-2019-2390. The attack must be carried out locally. There is no available exploit. Upgrading the affected component is recommended. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Detailsinfo

A vulnerability was found in MongoDB up to 3.4.21/3.6.13/4.0.10 on Windows (Database Software) and classified as critical. Affected by this issue is an unknown code block of the component OpenSSL. The manipulation as part of a Configuration File leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14 and MongoDB Server v3.4 prior to 3.4.22.

The weakness was presented 08/30/2019 (Website). The advisory is shared for download at jira.mongodb.org. This vulnerability is handled as CVE-2019-2390 since 12/10/2018. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 3.4.22, 3.6.14 or 4.0.11 eliminates this vulnerability.

See VDB-141187 for similar entry. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Database Software

Name

• MongoDB

Version

• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4
• 3.4.5
• 3.4.6
• 3.4.7
• 3.4.8
• 3.4.9
• 3.4.10
• 3.4.11
• 3.4.12
• 3.4.13
• 3.4.14
• 3.4.15
• 3.4.16
• 3.4.17
• 3.4.18
• 3.4.19
• 3.4.20
• 3.4.21
• 3.6.0
• 3.6.1
• 3.6.2
• 3.6.3
• 3.6.4
• 3.6.5
• 3.6.6
• 3.6.7
• 3.6.8
• 3.6.9
• 3.6.10
• 3.6.11
• 3.6.12
• 3.6.13
• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.0.8
• 4.0.9
• 4.0.10

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion