7.8

CVE-2024-7553

Accessing Untrusted Directory May Allow Local Privilege Escalation

Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1.

Required Configuration:

Only environments with Windows as the underlying operating system is affected by this issue
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
MongoDB ≫ MongoDB Version >= 5.0.0 < 5.0.27
   Microsoft ≫ Windows 10 1507 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1511 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1703 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1709 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1803 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1809 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1903 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1909 Version - HwPlatform x64
   Microsoft ≫ Windows 10 2004 Version - HwPlatform x64
   Microsoft ≫ Windows 10 20h2 Version - HwPlatform x64
   Microsoft ≫ Windows 10 21h1 Version - HwPlatform x64
   Microsoft ≫ Windows 10 21h2 Version - HwPlatform x64
   Microsoft ≫ Windows 10 22h2 Version - HwPlatform x64
   Microsoft ≫ Windows Server 2016 Version -
   Microsoft ≫ Windows Server 2019 Version -
MongoDB ≫ MongoDB Version >= 6.0.0 < 6.0.16
   Microsoft ≫ Windows 10 1507 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1511 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1703 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1709 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1803 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1809 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1903 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1909 Version - HwPlatform x64
   Microsoft ≫ Windows 10 2004 Version - HwPlatform x64
   Microsoft ≫ Windows 10 20h2 Version - HwPlatform x64
   Microsoft ≫ Windows 10 21h1 Version - HwPlatform x64
   Microsoft ≫ Windows 10 21h2 Version - HwPlatform x64
   Microsoft ≫ Windows 10 22h2 Version - HwPlatform x64
   Microsoft ≫ Windows Server 2016 Version -
   Microsoft ≫ Windows Server 2019 Version -
MongoDB ≫ MongoDB Version >= 7.0.0 < 7.0.12
   Microsoft ≫ Windows 11 Version -
   Microsoft ≫ Windows 11 21h2 Version - HwPlatform x64
   Microsoft ≫ Windows 11 22h2 Version - HwPlatform x64
   Microsoft ≫ Windows 11 23h2 Version - HwPlatform x64
   Microsoft ≫ Windows Server 2019 Version -
   Microsoft ≫ Windows Server 2022 Version -
MongoDB ≫ MongoDB Version >= 7.3.0 < 7.3.3
   Microsoft ≫ Windows 11 Version -
   Microsoft ≫ Windows 11 21h2 Version - HwPlatform x64
   Microsoft ≫ Windows 11 22h2 Version - HwPlatform x64
   Microsoft ≫ Windows 11 23h2 Version - HwPlatform x64
   Microsoft ≫ Windows Server 2019 Version -
   Microsoft ≫ Windows Server 2022 Version -
MongoDB ≫ C Driver SwPlatform mongodb Version < 1.26.2
   Microsoft ≫ Windows 10 1507 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1511 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1703 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1709 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1803 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1809 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1903 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1909 Version - HwPlatform x64
   Microsoft ≫ Windows 10 2004 Version - HwPlatform x64
   Microsoft ≫ Windows 10 20h2 Version - HwPlatform x64
   Microsoft ≫ Windows 10 21h1 Version - HwPlatform x64
   Microsoft ≫ Windows 10 21h2 Version - HwPlatform x64
   Microsoft ≫ Windows 10 22h2 Version - HwPlatform x64
   Microsoft ≫ Windows 11 Version -
   Microsoft ≫ Windows 11 21h2 Version - HwPlatform x64
   Microsoft ≫ Windows 11 22h2 Version - HwPlatform x64
   Microsoft ≫ Windows 11 23h2 Version - HwPlatform x64
   Microsoft ≫ Windows Server 2016 Version -
   Microsoft ≫ Windows Server 2019 Version -
   Microsoft ≫ Windows Server 2022 Version -
MongoDB ≫ Php Driver SwPlatform mongodb Version < 1.18.1
   Microsoft ≫ Windows 10 1507 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1511 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1607 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1703 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1709 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1803 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1809 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1903 Version - HwPlatform x64
   Microsoft ≫ Windows 10 1909 Version - HwPlatform x64
   Microsoft ≫ Windows 10 2004 Version - HwPlatform x64
   Microsoft ≫ Windows 10 20h2 Version - HwPlatform x64
   Microsoft ≫ Windows 10 21h1 Version - HwPlatform x64
   Microsoft ≫ Windows 10 21h2 Version - HwPlatform x64
   Microsoft ≫ Windows 10 22h2 Version - HwPlatform x64
   Microsoft ≫ Windows 11 Version -
   Microsoft ≫ Windows 11 21h2 Version - HwPlatform x64
   Microsoft ≫ Windows 11 22h2 Version - HwPlatform x64
   Microsoft ≫ Windows 11 23h2 Version - HwPlatform x64
   Microsoft ≫ Windows Server 2016 Version -
   Microsoft ≫ Windows Server 2019 Version -
   Microsoft ≫ Windows Server 2022 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.171
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
MongoDb 7.3 1.3 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://jira.mongodb.org/browse/CDRIVER-5650
Vendor Advisory
https://jira.mongodb.org/browse/PHPC-2369
Vendor Advisory
https://jira.mongodb.org/browse/SERVER-93211
Vendor Advisory