Vulnerability · Published Aug 7, 2024 · Assigned by mongodb
CVE-2024-7553Accessing Untrusted Directory May Allow Local Privilege Escalation
High 7.3
In plain English
A high-severity improper access control in MongoDB C Driver from MongoDB Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Official description
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | mongo-c-driver | no fix listed | UBUNTU-CVE-2024-7553 |
| Ubuntu:24.04:LTS | mongo-c-driver | no fix listed | UBUNTU-CVE-2024-7553 |
| Ubuntu:22.04:LTS | php-mongodb | no fix listed | UBUNTU-CVE-2024-7553 |
| Ubuntu:24.04:LTS | php-mongodb | no fix listed | UBUNTU-CVE-2024-7553 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB Inc | MongoDB Server | 5.0 – before 5.0.276.0 – before 6.0.167.0 – before 7.0.127.3 – before 7.3.3 |
| MongoDB Inc | MongoDB C Driver | 0 – before 1.26.2 |
| MongoDB Inc | MongoDB PHP Driver | 0 – before 1.18.1 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H