An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14 and MongoDB Server v3.4 prior to 3.4.22.
References
Link | Resource |
---|---|
https://jira.mongodb.org/browse/SERVER-42233 | Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
AND |
|
History
23 Jan 2024, 15:15
Type | Values Removed | Values Added |
---|---|---|
Summary | An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14 and MongoDB Server v3.4 prior to 3.4.22. |
19 Jun 2023, 16:15
Type | Values Removed | Values Added |
---|---|---|
Summary | An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue affects: MongoDB Inc. MongoDB Server 4.0 prior to 4.0.11; 3.6 prior to 3.6.14; 3.4 prior to 3.4.22. |
Information
Published : 2019-08-30 15:15
Updated : 2024-02-28 17:08
NVD link : CVE-2019-2390
Mitre link : CVE-2019-2390
CVE.ORG link : CVE-2019-2390
JSON object : View
Products Affected
mongodb
- mongodb
microsoft
- windows
CWE