CVE-2024-1351

2024-03-0717:15:12

CWE-295

[email protected]

web.nvd.nist.gov

mongodb

server

tls

security

connection

certificate

validation

vulnerability

cve-2024-1351

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.4%

JSON

Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28.

Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "MongoDB Server",
    "vendor": "MongoDB Inc",
    "versions": [
      {
        "lessThanOrEqual": "7.0.5",
        "status": "affected",
        "version": "7.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "6.0.13",
        "status": "affected",
        "version": "6.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "5.0.24 ",
        "status": "affected",
        "version": "5.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.4.28",
        "status": "affected",
        "version": "4.4",
        "versionType": "custom"
      }
    ]
  }
]