CVE-2024-6384

Summary

"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versions prior to 7.3.3

Affected Software

VendorProductVersion RangeStatus
MongoDB IncMongoDB Server6.0 < 6.0.16affected
MongoDB IncMongoDB Server7.0 < 7.0.11affected
MongoDB IncMongoDB Server7.3 < 7.3.3affected

Weaknesses

  • CWE-285: CWE-285: Improper Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References