CVE-2024-6375CWE-285

Missing authorization check may lead to shard key refinement

Medium · published July 1, 2024

CVSS v3.1
5.4
EPSS
0%
Percentile
30.8
In the wild
Unconfirmed
What it is

A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degradation of query performance, or to revealing chunk boundaries through timing side channels. This affects MongoDB Server v5.0 versions, prior to 5.0.22, MongoDB Server v6.0 versions, prior to 6.0.11 and MongoDB Server v7.0 versions prior to 7.0.3.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00380 · 30.8th percentile
Weakness
CWE-285 · Improper Authorization
Published
2024-07-01T14:40Z
EPSS history
Timeline
  • 01 JUL 14:40Z
    Missing authorization check may lead to shard key refinement
    cvelistv5