Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2024-6375
HistoryJul 01, 2024 - 3:15 p.m.

CVE-2024-6375

2024-07-0115:15:17
CWE-862
CWE-285
[email protected]
web.nvd.nist.gov
5
authorization check missing
mongodb server
shard key refinement
query performance degradation
chunk boundaries
security vulnerability

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

EPSS

0.001

Percentile

17.1%

JSON

A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degradation of query performance, or to revealing chunk boundaries through timing side channels. This affects MongoDB Server v5.0 versions, prior to 5.0.22, MongoDB Server v6.0 versions, prior to 6.0.11 and MongoDB Server v7.0 versions prior to 7.0.3.

Affected configurations

Nvd
Node
mongodbmongodbRange5.0.0–5.0.22
OR
mongodbmongodbRange6.0.0–6.0.11
OR
mongodbmongodbRange7.0.0–7.0.3
VendorProductVersionCPE
mongodbmongodb*cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*

Related

openvas 2
cvelist 1
osv 3
mongodb 1
ubuntucve 1
vulnrichment 1
cve 1
openvas
openvas
MongoDB Missing Authorization Check Vulnerability (SERVER-79327) - Windows
2024-07-02 00:00:00
MongoDB Missing Authorization Check Vulnerability (SERVER-79327) - Linux
2024-07-02 00:00:00
cvelist
cvelist
CVE-2024-6375 Missing authorization check may lead to shard key refinement
2024-07-01 14:40:32
osv
osv
BIT-mongodb-2024-6375
2024-07-04 07:26:49
CVE-2024-6375
2024-07-01 15:15:17
UBUNTU-CVE-2024-6375
2024-07-01 15:15:00
mongodb
mongodb
Missing authorization check may lead to shard key refinement
2024-07-01 14:40:00
ubuntucve
ubuntucve
CVE-2024-6375
2024-07-01 00:00:00
vulnrichment
vulnrichment
CVE-2024-6375 Missing authorization check may lead to shard key refinement
2024-07-01 14:40:32
cve
cve
CVE-2024-6375
2024-07-01 15:15:17

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

EPSS

0.001

Percentile

17.1%

JSON
Related for NVD:CVE-2024-6375
openvas2cvelist1osv3mongodb1ubuntucve1vulnrichment1cve1