CVE-2021-20335: medium-severity vulnerability in MongoDB Ops Manager
SSL may be unexpectedly disabled during upgrade of multiple-server MongoDB Ops Manager
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.7epss 0.1%
For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager versions prior to and including 4.4.12 triggers a bug where Automation thinks SSL is being turned off, and can disable SSL temporarily for members of the cluster. This issue is temporary and eventually corrects itself after MongoDB Ops Manager instances have finished upgrading to MongoDB Ops Manager 4.4. In addition, customers must be running with clientCertificateMode=OPTIONAL / allowConnectionsWithoutCertificates=true to be impacted*.* Customers upgrading from Ops Manager 4.2.X to 4.2.24 and finally to Ops Manager 4.4.13+ are unaffected by this issue.
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected products
MongoDB Inc. · MongoDB Ops ManagerRelated CVEs — MongoDB Ops Manager
In the same product, most dangerous first.
CVE-2020-7927HIGHPotential privilege escalation in Ops Manager APIEPSS 1.0%CVE-2019-2388MEDIUMPotential exposure of log information in Ops ManagerEPSS 1.0%CVE-2023-0342LOWMongoDB Ops Manager may disclose sensitive information in Diagnostic ArchiveEPSS 0.9%CVE-2023-4009HIGHPrivilege Escalation for Project Owner and Project User Admin Roles in Ops ManagerEPSS 0.8%