SB2019083011 - Privilege escalation in MongoDB for Windows

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019083011

SB2019083011 - Privilege escalation in MongoDB for Windows

Published: August 30, 2019 Updated: September 24, 2019

Security Bulletin ID SB2019083011
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-2390)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way MongoDB uses OpenSSL, when installed on Windows. A local unprivileged user with ability to create OpenSSL configuration files in a fixed location can modify OpenSSL configuration files and execute arbitrary code on the system via utility programs, shipped with MongoDB server.

Successful exploitation of the vulnerability requires that a legitimate user runs MongoDB utility programs.


Remediation

Install update from vendor's website.

References