Auth bypass in MongoDB
CVE-2024-6384
"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versions prior to 7.3.3
EPSS: 0.004 (35.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Mongodb
- Mongodb Inc Server — versions 6.0, 7.0, 7.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@mongodb.com (Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2024-6384?
- CVE-2024-6384 is a medium-severity vulnerability in MongoDB, classified under Improper Authorization. CVSS score: 5.3/10. Published 2024-08-13.
- How severe is CVE-2024-6384?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2024-6384 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.