CVE-2023-1409

If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in effect, potentially allowing client to establish a TLS connection with the server that supplies any certificate. This issue affect all MongoDB Server v6.3 versions, MongoDB Server v5.0 versions v5.0.0 to v5.0.14 and all MongoDB Server v4.4 versions.

CVSS v3.0 7.5 HIGH

7.5^/10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://jira.mongodb.org/browse/SERVER-73662	Issue Tracking Patch Vendor Advisory
https://jira.mongodb.org/browse/SERVER-73662	Issue Tracking Patch Vendor Advisory
https://jira.mongodb.org/browse/SERVER-77028	Issue Tracking Patch Vendor Advisory
https://jira.mongodb.org/browse/SERVER-77028	Issue Tracking Patch Vendor Advisory
https://security.netapp.com/advisory/ntap-20230921-0007/
https://security.netapp.com/advisory/ntap-20230921-0007/

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:mongodb:mongodb::::::::
	cpe:2.3:a:mongodb:mongodb::::::::
	cpe:2.3:a:mongodb:mongodb::::::::
	cpe:2.3:a:mongodb:mongodb::::::::

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

13 Feb 2025, 17:15

Type	Values Removed	Values Added
Summary	If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in effect, potentially allowing client to establish a TLS connection with the server that supplies any certificate. This issue affect all MongoDB Server v6.3 versions, MongoDB Server v5.0 versions v5.0.0 to v5.0.14 and all MongoDB Server v4.4 versions.	If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in effect, potentially allowing client to establish a TLS connection with the server that supplies any certificate. This issue affect all MongoDB Server v6.3 versions, MongoDB Server v5.0 versions v5.0.0 to v5.0.14 and all MongoDB Server v4.4 versions.
References		() https://security.netapp.com/advisory/ntap-20230921-0007/ -
References	~~(MISC) https://jira.mongodb.org/browse/SERVER-77028 - Issue Tracking, Patch, Vendor Advisory~~	() https://jira.mongodb.org/browse/SERVER-77028 - Issue Tracking, Patch, Vendor Advisory
References	~~(MISC) https://jira.mongodb.org/browse/SERVER-73662 - Issue Tracking, Patch, Vendor Advisory~~	() https://jira.mongodb.org/browse/SERVER-73662 - Issue Tracking, Patch, Vendor Advisory

29 Aug 2023, 16:55

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
References	~~(MISC) https://jira.mongodb.org/browse/SERVER-77028 -~~	(MISC) https://jira.mongodb.org/browse/SERVER-77028 - Issue Tracking, Patch, Vendor Advisory
References	~~(MISC) https://jira.mongodb.org/browse/SERVER-73662 -~~	(MISC) https://jira.mongodb.org/browse/SERVER-73662 - Issue Tracking, Patch, Vendor Advisory
CPE		cpe:2.3:a:mongodb:mongodb:::::::: cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:o:apple:macos:-:::::::*
CWE		CWE-295
First Time		Apple Mongodb mongodb Mongodb Microsoft Microsoft windows Apple macos

23 Aug 2023, 16:33

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-08-23 16:15

Updated : 2025-02-13 17:15

NVD link : CVE-2023-1409

Mitre link : CVE-2023-1409

JSON object : View

Products Affected

mongodb

mongodb

apple

macos

microsoft

windows

CWE

CWE-295

Improper Certificate Validation

7.5 /10