Vulnerability in Mongodb Ops Manager Server
CVE-2023-0342
MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12
EPSS: 0.009 (55.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N.
Affected products
- Mongodb Ops_manager_server
- Mongodb Inc. Ops Manager — versions v5.0, v6.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@mongodb.com (Release Notes)
- cna@mongodb.com (Release Notes)
Frequently asked questions
- What is CVE-2023-0342?
- CVE-2023-0342 is a low-severity vulnerability in Mongodb Ops Manager Server, classified under Exposure of Sensitive System Information to an Unauthorized Control Sphere. CVSS score: 3.1/10. Published 2023-06-09.
- How severe is CVE-2023-0342?
- Low severity. CVSS v3 base score is 3.1 out of 10.
- Is CVE-2023-0342 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.