CVE-2024-7553highCWE-284

CVE-2024-7553: fallo de gravedad alta en MongoDB Server

Accessing Untrusted Directory May Allow Local Privilege Escalation

Publicada el

Seguir esta CVE+ Monitorear MongoDB Server+ Monitorear C Driver

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.3epss 0.3%
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Productos afectados
MongoDB Inc · MongoDB C DriverMongoDB Inc · MongoDB PHP DriverMongoDB Inc · MongoDB Server
CVEs relacionadas — MongoDB Server

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-0437MEDIUMMongoDB client C Driver may infinitely loop when validating certain BSON input dataEPSS 1.1%CVE-2026-25611HIGHPre-Authentication Memory Exhaustion Denial of Service in MongoDB ServerEPSS 0.9%CVE-2025-0755HIGHMongoDB C Driver bson library may be susceptible to buffer overflowEPSS 0.8%CVE-2021-32050MEDIUMSome MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an applicationEPSS 0.6%CVE-2024-8305MEDIUMMongoDB Server secondaries may crash due to forced index constraintsEPSS 0.6%CVE-2024-10921MEDIUMImproper neutralization of null bytes may lead to buffer over-reads in MongoDB ServerEPSS 0.6%