VULNERABILITY INTELLIGENCE

CVE-2023-4009

CVSS score7.2 HIGH
EPSS probability0.76%
CISA KEVNot currently listed
Published2023-08-08
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation.

Weakness classification

  • cna@mongodb.com: CWE-648
  • nvd@nist.gov: CWE-269

Primary references