MongoDB Ops Manager may disclose sensitive information in Diagnostic Archive
CVE-2023-0342

3.1LOW

Key Information:

Vendor

MongoDB
Status
Mongodb Ops Manager
Vendor
CVE Published:
9 June 2023

What is CVE-2023-0342?

MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12

Affected Version(s)

MongoDB Ops Manager v5.0 < 5.0.21

MongoDB Ops Manager v6.0 < 6.0.12

References

https://www.mongodb.com/docs/ops-manager/current/release-...
https://www.mongodb.com/docs/ops-manager/current/release-...

EPSS Score

23% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.