Описание
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1.
Required Configuration:
Only environments with Windows as the underlying operating system is affected by this issue
Затрагиваемое ПО
Mongodb MongodbMicrosoft Windows 10 1507Microsoft Windows 10 1511Microsoft Windows 10 1607Microsoft Windows 10 1703Microsoft Windows 10 1709Microsoft Windows 10 1803Microsoft Windows 10 1809Microsoft Windows 10 1903Microsoft Windows 10 1909Microsoft Windows 10 2004Microsoft Windows 10 20h2Microsoft Windows 10 21h1Microsoft Windows 10 21h2Microsoft Windows 10 22h2Microsoft Windows server 2016Microsoft Windows server 2019Microsoft Windows 11Microsoft Windows 11 21h2Microsoft Windows 11 22h2Microsoft Windows 11 23h2Microsoft Windows server 2022Mongodb C driverMongodb Php driver
CVSS
| Балл | 7.3 — высокая |
| Вектор | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Источники
https://jira.mongodb.org/browse/CDRIVER-5650https://jira.mongodb.org/browse/PHPC-2369https://jira.mongodb.org/browse/SERVER-93211