CVE-2020-7927

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 and MongoDB Ops Manager v4.4 versions prior to and including 4.4.2.

CVSS v3 8.1 HIGH
CVSS v2.0 4.0 MEDIUM

8.1^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-4.4.3
https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-4.4.3

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mongodb:ops_manager::::::::
	cpe:2.3:a:mongodb:ops_manager::::::::
	cpe:2.3:a:mongodb:ops_manager::::::::

History

21 Nov 2024, 05:38

Type	Values Removed	Values Added
CVSS	v2 : ~~4.0~~ v3 : ~~6.5~~	v2 : 4.0 v3 : 8.1
References	~~() https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-4.4.3 -~~	() https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-4.4.3 -

17 Sep 2024, 02:15

Type	Values Removed	Values Added
Summary	(en) Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 and MongoDB Ops Manager v4.4 versions prior to and including 4.4.2.	(en) Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 and MongoDB Ops Manager v4.4 versions prior to and including 4.4.2.

23 Jan 2024, 16:15

Type	Values Removed	Values Added
Summary	Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions 4.2.0-4.2.17, v4.3 versions 4.3.0-4.3.9 and v4.4 versions 4.4.0-4.4.2.	Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 and MongoDB Ops Manager v4.4 versions prior to and including 4.4.2.
References	{'url': 'https://docs.opsmanager.mongodb.com/current/release-notes/application/#onprem-server-4-4-3', 'name': 'https://docs.opsmanager.mongodb.com/current/release-notes/application/#onprem-server-4-4-3', 'tags': ['Release Notes', 'Vendor Advisory'], 'refsource': 'CONFIRM'}	() https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-4.4.3 -

Information

Published : 2020-11-23 19:15

Updated : 2024-11-21 05:38

NVD link : CVE-2020-7927

Mitre link : CVE-2020-7927

CVE.ORG link : CVE-2020-7927

JSON object : View

Products Affected

mongodb

ops_manager

CWE

CWE-648

Incorrect Use of Privileged APIs

NVD-CWE-noinfo

8.1 /10