Skip to main content

Improper Access Control

CVE-2024-7553

High
7.8/10

Summary

Incorrect validation of files loaded from a local, untrusted directory may allow local privilege escalation if the underlying operating system is Windows. This may result in the application executing arbitrary behavior determined by the contents of untrusted files. This issue affects MongoDB Server r5.0.x versions prior to r5.0.27-rc0, MongoDB Server r6.0.x versions prior to r6.0.16-rc0, MongoDB Server r7.0.x versions prior to r7.0.12-rc0, MongoDB Server r7.3.x versions prior to r7.3.3-rc0, MongoDB C Driver versions prior to 1.26.2, and MongoDB PHP Driver versions prior to 1.18.1. Note: Only environments with Windows as the underlying operating system are affected by this issue.

  • LOW
  • LOCAL
  • HIGH
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • HIGH

CWE-284 - Improper Access Control

Listed 5th in the 'OWASP Top Ten', improper (or broken) access control attacks are a fundamental type of vulnerability. This includes a broad range of design flaws that enable users to act outside of their intended permissions. They can use these privileges to gain access to restricted files and functionality such as accessing restricted information, falsifying records, destroying data, or executing commands.

References

Advisory Timeline

  • Published