Missing Authorization Check in MongoDB Shard Commands Can Lead to Security Risks
CVE-2024-6375

6.5MEDIUM

Key Information:

Vendor
MongoDB
Status
Mongodb Server
Vendor
CVE Published:
1 July 2024

Summary

A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degradation of query performance, or to revealing chunk boundaries through timing side channels. This affects MongoDB Server v5.0 versions, prior to 5.0.22, MongoDB Server v6.0 versions, prior to 6.0.11 and MongoDB Server v7.0 versions prior to 7.0.3.

Affected Version(s)

MongoDB Server 5.0 < 5.0.22

MongoDB Server 6.0 < 6.0.11

MongoDB Server 7.0 < 7.0.3

References

https://jira.mongodb.org/browse/SERVER-79327

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.