Log in Start free

Vulnerability · Published Apr 9, 2020 · Assigned by mongodb

CVE-2020-7922Kubernetes Operator generates potentially insecure certificates

Medium 6.4

In plain English

A medium-severity improper certificate validation in MongoDB Enterprise Kubernetes Operator from MongoDB Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.7%top 47.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates are unaffected. This issue affects MongoDB Enterprise Kubernetes Operator version 1.0, MongoDB Enterprise Kubernetes Operator version 1.1, MongoDB Enterprise Kubernetes Operator version 1.2 versions prior to 1.2.4, MongoDB Enterprise Kubernetes Operator version 1.3 versions prior to 1.3.1, 1.2, 1.4 versions prior to 1.4.4.

Affected products (as reported)

VendorProductVersions
MongoDB Inc. MongoDB Enterprise Kubernetes Operator 1.01.11.2 – through 1.2.41.3 – through 1.3.11.4 – through 1.4.4

Weakness: CWE-295 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References