Lucene search

RedhatCVE-2014-8180

HistoryJun 06, 2017 - 6:29 p.m.

CVE-2014-8180

2017-06-0618:29:00

CWE-287

redhat

web.nvd.nist.gov

cve-2014-8180

mongodb

red hat satellite 6

local users

authentication bypass

empty password

information deletion

denial of service

nvd

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

5.5

Confidence

High

EPSS

Percentile

5.1%

JSON

MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information which can cause a Denial of Service.

Affected configurations

Nvd

Node

redhatsatelliteMatch6.0

AND

mongodbmongodb

VendorProductVersionCPE
redhatsatellite6.0cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*
mongodbmongodb*cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	satellite	6.0	cpe:2.3:a:redhat:satellite:6.0:::::::*
mongodb	mongodb	*	cpe:2.3:a:mongodb:mongodb::::::::

References

access.redhat.com/documentation/en-us/red_hat_satellite/6.2/html/installation_guide/preparing_your_environment_for_installation#restricting_access_to_mongod

bugzilla.redhat.com/show_bug.cgi?id=1301703

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

5.5

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2014-8180