CVE-2023-0342

MongoDB Ops Manager may disclose sensitive information in Diagnostic Archive

MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12

Affected

MongoDB Inc. · MongoDB Ops Manager

CVSS v3.1 NVD

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v3.1 MONGODB

3.1 LOWCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

EPSS

0.89% chance of exploitation in the next 30 days, 59th percentile

Published

2023-06-09

Updated

2025-01-06

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/mongodb_ops_manager_diag…

Security advisories

• https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server…
• https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server…

References

• CVE Record
• NVD entry