CVE-2023-0436

2023-11-0712:15:08

CWE-532

mongodb

web.nvd.nist.gov

mongodb

atlas

kubernetes

operator

cve-2023-0436

gcp

security

vulnerability

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

37.2%

JSON

The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6.0, 1.6.1, 1.7.0.

Please note that this is reported on an EOL version of the product, and users are advised to upgrade to the latest supported version.
Required Configuration:

DEBUG logging is not enabled by default, and must be configured by the end-user. To check the log-level of the Operator, review the flags passed in your deployment configuration (eg. https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 )

Affected configurations

Nvd

Node

mongodbatlas_kubernetes_operatorRange1.6.0–1.7.1

mongodbatlas_kubernetes_operatorMatch1.5.0

VendorProductVersionCPE
mongodbatlas_kubernetes_operator*cpe:2.3:a:mongodb:atlas_kubernetes_operator:*:*:*:*:*:*:*:*
mongodbatlas_kubernetes_operator1.5.0cpe:2.3:a:mongodb:atlas_kubernetes_operator:1.5.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mongodb	atlas_kubernetes_operator	*	cpe:2.3:a:mongodb:atlas_kubernetes_operator::::::::
mongodb	atlas_kubernetes_operator	1.5.0	cpe:2.3:a:mongodb:atlas_kubernetes_operator:1.5.0:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "MongoDB Atlas Kubernetes Operator",
    "vendor": "MongoDB Inc",
    "versions": [
      {
        "lessThanOrEqual": "1.7.0",
        "status": "affected",
        "version": "1.5.0",
        "versionType": "custom"
      }
    ]
  }
]