Vulnerability · Published Jun 9, 2023 · Assigned by mongodb
CVE-2023-0342MongoDB Ops Manager may disclose sensitive information in Diagnostic Archive
Low 3.1
In plain English
A low-severity security flaw in MongoDB Ops Manager from MongoDB Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.9%top 40.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Metasploit
Official description
MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB Inc. | MongoDB Ops Manager | v5.0 – before 5.0.21v6.0 – before 6.0.12 |
Weakness: CWE-497 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N