Mongodb Inc Mongodb Ops Manager vulnerabilities
5 known vulnerabilities affecting mongodb_inc/mongodb_ops_manager.
Total CVEs
5
CISA KEV
0
Public exploits
1
Exploited in wild
0
Severity breakdown
HIGH1MEDIUM4
Vulnerabilities
Page 1 of 1
CVE-2023-0342P3MEDIUMCVSS 5.3PoC≥ v5.0, < 5.0.21≥ v6.0, < 6.0.122023-06-09
CVE-2023-0342 [MEDIUM] CWE-497 CVE-2023-0342: MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings.
MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12
nvd
CVE-2023-4009P3HIGHCVSS 7.2≥ 6.0, < 6.0.17≥ 5.0, < 5.0.222023-08-08
CVE-2023-4009 [HIGH] CWE-648 CVE-2023-4009: In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authentic
In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation.
nvd
CVE-2020-7927P3MEDIUMCVSS 6.5≥ 4.2, ≤ 4.2.17≥ 4.3, ≤ 4.3.9+1 more2020-11-23
CVE-2020-7927 [MEDIUM] CWE-648 CVE-2020-7927: Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege t
Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 and MongoDB Ops Manager v4.4 versions prior to and includi
nvd
CVE-2019-2388P4MEDIUMCVSS 5.3v4.0.9v4.0.10+1 more2020-05-13
CVE-2019-2388 [MEDIUM] CWE-425 CVE-2019-2388: In affected Ops Manager versions there is an exposed http route was that may allow attackers to view
In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance. This issue affects: MongoDB Inc. MongoDB Ops Manager 4.0 versions 4.0.9, 4.0.10 and MongoDB Ops Manager 4.1 version 4.1.5.
nvd
CVE-2021-20335P4MEDIUMCVSS 4.6≥ 4.2, ≤ 4.2.242021-02-11
CVE-2021-20335 [MEDIUM] CWE-319 CVE-2021-20335: For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers,
For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager versions prior to and including 4.4.12 triggers a bug where Automation thinks SSL is being turned off, and can disable SSL temporarily for members of the cluster.
nvd