CVEvulnerability

CVE-2023-4009

7.2 HIGH Published 2023-08-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-08-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269, CWE-648

Description

In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation.

Affected configurations

• mongodb ops manager server (>= 5.0.0 < 5.0.22) • mongodb ops manager server (>= 6.0.0 < 6.0.17)

Related

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-648 Incorrect Use of Privileged APIs weakness

References