CVEvulnerability

CVE-2020-7927

6.5 MEDIUM Published 2020-11-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-11-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-648

Description

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 and MongoDB Ops Manager v4.4 versions prior to and including 4.4.2.

Affected configurations

• mongodb ops manager (>= 4.2.0 <= 4.2.17) • mongodb ops manager (>= 4.3.0 <= 4.3.9) • mongodb ops manager (>= 4.4.0 <= 4.4.2)

Related

Weakness · CWE (1)

  • CWE-648 Incorrect Use of Privileged APIs weakness

References