CVE-2020-7922CWE-295

Kubernetes Operator generates potentially insecure certificates

Medium · published April 9, 2020

CVSS v3.1
6.4
EPSS
1%
Percentile
51.3
In the wild
Unconfirmed
What it is

X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates are unaffected. This issue affects MongoDB Enterprise Kubernetes Operator version 1.0, MongoDB Enterprise Kubernetes Operator version 1.1, MongoDB Enterprise Kubernetes Operator version 1.2 versions prior to 1.2.4, MongoDB Enterprise Kubernetes Operator version 1.3 versions prior to 1.3.1, 1.2, 1.4 versions prior to 1.4.4.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00668 · 51.3th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2020-04-09T17:35Z
EPSS history
Timeline
  • 09 APR 17:35Z
    Kubernetes Operator generates potentially insecure certificates
    cvelistv5