CVE-2023-4009
High
Description
In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation.
SeverityHigh
CVSS7.2
Exploit probability—
Product
Mongodb Ops Manager Server
PublishedAug 8, 2023
First seenAug 8, 2023
Weakness typeCWE-648CWE-648
How to fix
Update
- mongodb ops_manager_server5.0.22, 6.0.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mongodb ops_manager_server | 5.0.0 ≤ v < 5.0.22, 6.0.0 ≤ v < 6.0.17 | 5.0.22, 6.0.17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.