Uploaded image for project: 'C Driver'
  1. C Driver
  2. CDRIVER-5650

Accessing Untrusted Directory May Allow Local Privilege Escalation

XMLWordPrintableJSON

    • Type: Icon: Bug Bug
    • Resolution: Duplicate
    • Priority: Icon: Major - P3 Major - P3
    • 1.26.2
    • Affects Version/s: None
    • Component/s: None
    • None
    • C Drivers
    • Hide

      1. What would you like to communicate to the user about this feature?
      2. Would you like the user to see examples of the syntax and/or executable code and its output?
      3. Which versions of the driver/connector does this apply to?

      Show
      1. What would you like to communicate to the user about this feature? 2. Would you like the user to see examples of the syntax and/or executable code and its output? 3. Which versions of the driver/connector does this apply to?

      CVE ID:
      CVE-2024-7553

      Title:  

      Accessing Untrusted Directory May Allow Local Privilege Escalation

      Description:

      Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1.

      CVSS Score: 

      7.3 - https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

      List all affected product versions:

      MongoDB Server v5.0 versions prior to 5.0.27

      MongoDB Server v6.0 versions prior to 6.0.16

      MongoDB Server v7.0 versions prior to 7.0.12

      MongoDB Server v7.3 versions prior 7.3.3

      MongoDB C Driver versions prior to 1.26.2

      MongoDB PHP Driver versions prior to 1.18.1

      CWE: 

      CWE-284: Improper Access Control

      Required Configuration:

      Only environments with Windows as the underlying operating system is affected by this issue

            Assignee:
            kevin.albertson@mongodb.com Kevin Albertson
            Reporter:
            karman.liu@mongodb.com Karman Liu
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: