7.5

CVE-2023-1409

If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in effect, potentially allowing client to establish a TLS connection with the server that supplies any certificate.

This issue affect all MongoDB Server v6.3 versions, MongoDB Server v5.0 versions v5.0.0 to v5.0.14 and all MongoDB Server v4.4 versions.

Data is provided by the National Vulnerability Database (NVD)
Mongodb ≫ Mongodb Version >= 4.4.0 < 4.4.23
   Apple ≫ macOS Version-
   Microsoft ≫ Windows Version-
Mongodb ≫ Mongodb Version >= 5.0.0 <= 5.0.14
   Apple ≫ macOS Version-
   Microsoft ≫ Windows Version-
Mongodb ≫ Mongodb Version >= 6.0.0 < 6.0.7
   Apple ≫ macOS Version-
   Microsoft ≫ Windows Version-
Mongodb ≫ Mongodb Version >= 6.3.0 <= 6.3.2
   Apple ≫ macOS Version-
   Microsoft ≫ Windows Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.25% 0.488
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
cna@mongodb.com 5.3 1.6 3.6
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

https://jira.mongodb.org/browse/SERVER-73662
Patch
Vendor Advisory
Issue Tracking
https://jira.mongodb.org/browse/SERVER-77028
Patch
Vendor Advisory
Issue Tracking