MongoDB Ops Manager up to 5.0.20/6.0.11 Diagnostics Archive information expsure

Summaryinfo

A vulnerability was found in MongoDB Ops Manager up to 5.0.20/6.0.11. It has been classified as problematic. Impacted is an unknown function of the component Diagnostics Archive. Performing a manipulation results in information expsure. This vulnerability is cataloged as CVE-2023-0342. The attack must be initiated from a local position. Furthermore, there is an exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, was found in MongoDB Ops Manager up to 5.0.20/6.0.11 (Database Software). This affects an unknown code block of the component Diagnostics Archive. The manipulation with an unknown input leads to a information expsure vulnerability. CWE is classifying the issue as CWE-497. The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. This is going to have an impact on confidentiality, and integrity. The summary by CVE is:

MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12

The weakness was shared 06/09/2023. It is possible to read the advisory at mongodb.com. This vulnerability is uniquely identified as CVE-2023-0342 since 01/17/2023. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

The exploit is shared for download at packetstormsecurity.com. It is declared as highly functional.

Upgrading to version 5.0.21 or 6.0.12 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Database Software

Vendor

• MongoDB

Name

• Ops Manager

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.0.8
• 5.0.9
• 5.0.10
• 5.0.11
• 5.0.12
• 5.0.13
• 5.0.14
• 5.0.15
• 5.0.16
• 5.0.17
• 5.0.18
• 5.0.19
• 5.0.20
• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4
• 6.0.5
• 6.0.6
• 6.0.7
• 6.0.8
• 6.0.9
• 6.0.10
• 6.0.11

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion