CVE-2024-7553highCWE-284

CVE-2024-7553: falha de alta gravidade em MongoDB Server

Accessing Untrusted Directory May Allow Local Privilege Escalation

Publicada em

Seguir esta CVE+ Monitorar MongoDB Server+ Monitorar C Driver

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.3epss 0.3%
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
MongoDB Inc · MongoDB C DriverMongoDB Inc · MongoDB PHP DriverMongoDB Inc · MongoDB Server
CVEs relacionadas — MongoDB Server

No mesmo produto, das mais perigosas para as menos.

CVE-2023-0437MEDIUMMongoDB client C Driver may infinitely loop when validating certain BSON input dataEPSS 1.1%CVE-2026-25611HIGHPre-Authentication Memory Exhaustion Denial of Service in MongoDB ServerEPSS 0.9%CVE-2025-0755HIGHMongoDB C Driver bson library may be susceptible to buffer overflowEPSS 0.8%CVE-2021-32050MEDIUMSome MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an applicationEPSS 0.6%CVE-2024-8305MEDIUMMongoDB Server secondaries may crash due to forced index constraintsEPSS 0.6%CVE-2024-10921MEDIUMImproper neutralization of null bytes may lead to buffer over-reads in MongoDB ServerEPSS 0.6%