Improper Authentication in MongoDB - CVE-2019-2386

Vulnerability identifier: #VU19973

CSH Severity: Low

CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-2386

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when handling user deletion. A remote attacker with access to a previously created session token can reuse that token to access database after the account was deleted. 

MongoDB
Ubuntu
mongodb-server (Ubuntu package)
mongodb-clients (Ubuntu package)
mongodb-server-core (Ubuntu package)

Install updates from vendor's website.

MongoDB - addressed in versions 3.4.22, 3.6.13, 4.0.9
mongodb-server (Ubuntu package) - addressed in versions 1:3.6.3-0ubuntu1.3, 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2
mongodb-clients (Ubuntu package) - addressed in versions 1:3.6.3-0ubuntu1.3, 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2
mongodb-server-core (Ubuntu package) - addressed in versions 1:3.6.3-0ubuntu1.3, 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2

• https://jira.mongodb.org/browse/SERVER-38984
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0829

• Improper authentication in MongoDB Server
• Ubuntu update for mongodb