CVE-2020-7927CWE-648

Potential privilege escalation in Ops Manager API

High · published November 23, 2020

CVSS v3.1
8.1
EPSS
1%
Percentile
63.8
In the wild
Unconfirmed
What it is

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 and MongoDB Ops Manager v4.4 versions prior to and including 4.4.2.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01044 · 63.8th percentile
Weakness
CWE-648 · Incorrect Use of Privileged APIs
Published
2020-11-23T19:00Z
EPSS history
Timeline
  • 23 NOV 19:00Z
    Potential privilege escalation in Ops Manager API
    cvelistv5