Specific command line parameter might result in accepting invalid certificate
CVE-2020-7924

4.2MEDIUM

Key Information:

Vendor

MongoDB
Status
Mongodb Database Tools
Mongomirror
Vendor
CVE Published:
12 April 2021

What is CVE-2020-7924?

Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions later than 3.6.5; 3.6 versions prior to 3.6.21; 4.0 versions prior to 4.0.21; 4.2 versions prior to 4.2.11; 100 versions prior to 100.2.0. MongoDB Inc. Mongomirror 0 versions later than 0.6.0.

Affected Version(s)

MongoDB Database Tools 3.6.5 <= 3.6.21

MongoDB Database Tools 4.0 < 4.0.21

MongoDB Database Tools 4.2 < 4.2.11

References

https://jira.mongodb.org/browse/TOOLS-2587
x_refsource_MISC

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.