Potential privilege escalation in Ops Manager API
CVE-2020-7927

6.5MEDIUM

Key Information:

Vendor
MongoDB
Status
Mongodb Ops Manager
Vendor
CVE Published:
23 November 2020

Summary

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 and MongoDB Ops Manager v4.4 versions prior to and including 4.4.2.

Affected Version(s)

MongoDB Ops Manager 4.2 <= 4.2.17

MongoDB Ops Manager 4.3 <= 4.3.9

MongoDB Ops Manager 4.4 <= 4.4.2

References

https://www.mongodb.com/docs/ops-manager/current/release-...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.