Code execution on Windows via OpenSSL engine injection
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 1.0%
probabilidade de exploração
1.0%top 40% das CVEs
exploração observada
nãonenhuma fonte reporta
An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14 and MongoDB Server v3.4 prior to 3.4.22.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
MongoDB Inc. · MongoDB ServerReferências
https://jira.mongodb.org/browse/SERVER-42233