Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-79327

Missing verification in refine collection shard key

XMLWordPrintableJSON

    • Sharding EMEA
    • Fully Compatible
    • ALL
    • v6.0, v5.0
    • Sharding EMEA 2023-08-07, Sharding EMEA 2023-08-21, Sharding EMEA 2023-09-04, Sharding EMEA 2023-10-02
    • 1

      CVE ID:
      CVE-2024-6375

      Title:
      Missing authorization check may lead to shard key refinement

      Description:
      A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degradation of query performance, or to revealing chunk boundaries through timing side channels. This affects MongoDB Server v5.0 versions, prior to 5.0.22, MongoDB Server v6.0 versions, prior to 6.0.11 and MongoDB Server v7.0 versions prior to 7.0.3.

      CVSS Score:

      This issue's CVSS:3.1 severity is scored at 5.4 using the following scoring metrics:
      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

      List all affected product versions:
      MongoDB Server v5.0 versions, prior to 5.0.22

      MongoDB Server v6.0 versions, prior to 6.0.11

      MongoDB Server v7.0 versions prior to 7.0.3.

      CWE:

      CWE-285: Improper Authorization

            Assignee:
            antonio.fuschetto@mongodb.com Antonio Fuschetto
            Reporter:
            marcos.grillo@mongodb.com Marcos José Grillo Ramirez
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated:
              Resolved: