CVE-2019-2390

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
30/08/2019
Last modified:
23/01/2024

Description

<br /> An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14 and MongoDB Server v3.4 prior to 3.4.22.<br /> <br /> <br /> <br />

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* 3.4.0 (including) 3.4.22 (excluding)
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* 3.6.0 (including) 3.6.14 (excluding)
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* 4.0.0 (including) 4.0.11 (excluding)
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*


References to Advisories, Solutions, and Tools