Lucene search

K
ubuntucveUbuntu.comUB:CVE-2023-1409
HistoryAug 23, 2023 - 12:00 a.m.

CVE-2023-1409

2023-08-2300:00:00
ubuntu.com
ubuntu.com
25
mongodb
server
tls
configuration
vulnerability
windows
macos
client certificate
validation
cve-2023-1409
versions
unix

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

35.3%

If the MongoDB Server running on Windows or macOS is configured to use TLS
with a specific set of configuration options that are already known to work
securely in other platforms (e.g. Linux), it is possible that client
certificate validation may not be in effect, potentially allowing client to
establish a TLS connection with the server that supplies any certificate.
This issue affect all MongoDB Server v6.3 versions, MongoDB Server v5.0
versions v5.0.0 to v5.0.14 and all MongoDB Server v4.4 versions.

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

35.3%