CVE-2024-8207

2024-08-2712:15:04

CWE-610

CWE-114

mongodb

web.nvd.nist.gov

mongodb

linux

security vulnerability

shared libraries

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

9.5%

JSON

In certain highly specific configurations of the host system and MongoDB server binary installation on Linux Operating Systems, it may be possible for a unintended actor with host-level access to cause the MongoDB Server binary to load unintended actor-controlled shared libraries when the server binary is started, potentially resulting in the unintended actor gaining full control over the MongoDB server process. This issue affects MongoDB Server v5.0 versions prior to 5.0.14 and MongoDB Server v6.0 versions prior to 6.0.3.

Required Configuration: Only environments with Linux as the underlying operating system is affected by this issue

Affected configurations

Nvd

Node

mongodbmongodbRange5.0.0–5.0.14

mongodbmongodbRange6.0.0–6.0.3

mongodbmongodbRange6.1.0–6.1.1

AND

linuxlinux_kernelMatch-

VendorProductVersionCPE
mongodbmongodb*cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
linuxlinux_kernel-cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mongodb	mongodb	*	cpe:2.3:a:mongodb:mongodb::::::::
linux	linux_kernel	-	cpe:2.3:o:linux:linux_kernel:-:::::::*

CNA Affected

[
  {
    "cpes": [
      "cpe:2.3:a:mongodb:mongodb:5.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:mongodb:5.0.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:mongodb:5.0.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:mongodb:5.0.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:mongodb:5.0.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:mongodb:5.0.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:mongodb:5.0.6:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:mongodb:5.0.7:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:mongodb:5.0.8:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:mongodb:5.0.9:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:mongodb:5.0.10:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:mongodb:5.0.11:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:mongodb:5.0.12:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:mongodb:5.0.13:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:mongodb:6.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:mongodb:6.0.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:mongodb:6.0.2:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "product": "MongoDB Server",
    "vendor": "MongoDB Inc",
    "versions": [
      {
        "lessThan": "6.0.3",
        "status": "affected",
        "version": "6.0",
        "versionType": "custom"
      },
      {
        "lessThan": "5.0.14",
        "status": "affected",
        "version": "5.0",
        "versionType": "custom"
      }
    ]
  }
]