Vulnerability · Published Aug 8, 2023 · Assigned by mongodb
CVE-2023-4009Privilege Escalation for Project Owner and Project User Admin Roles in Ops Manager
High 7.2
In plain English
A high-severity security flaw in MongoDB Ops Manager from MongoDB Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.8%top 44.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB Inc. | MongoDB Ops Manager | 6.0 – before 6.0.175.0 – before 5.0.22 |
Weakness: CWE-648 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H