Authorization

2020-05-0615:15:00

PRIOn knowledge base

www.prio-n.com

5.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.7%

JSON

Improper serialization of internal state in the authorization subsystem in MongoDB Server’s authorization subsystem permits a user with valid credentials to bypass IP whitelisting protection mechanisms following administrative action. This issue affects MongoDB Server v4.2 versions prior to 4.2.3; MongoDB Server v4.0 versions prior to 4.0.15; MongoDB Server v4.3 versions prior to 4.3.3and MongoDB Server v3.6 versions prior to 3.6.18.

CPENameOperatorVersion
mongodbge4.2.0
mongodblt4.2.3
mongodbge4.0.0
mongodblt4.0.15
mongodbge3.6.0
mongodblt3.6.18
mongodbge4.3.0
mongodblt4.3.3

Name	Operator	Version
mongodb	ge	4.2.0
mongodb	lt	4.2.3
mongodb	ge	4.0.0
mongodb	lt	4.0.15
mongodb	ge	3.6.0
mongodb	lt	3.6.18
mongodb	ge	4.3.0
mongodb	lt	4.3.3

References

jira.mongodb.org/browse/SERVER-45472