CVE-2024-6384

EUVD-2024-47491
"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versions prior to 7.3.3
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
mongodbCNA
5.3 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 50%
Affected Products (NVD)
VendorProductVersion
mongodbmongodb
6.0.0 ≤
𝑥
< 6.0.16
mongodbmongodb
7.0.0 ≤
𝑥
< 7.0.11
mongodbmongodb
7.3.0 ≤
𝑥
< 7.3.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://jira.mongodb.org/browse/SERVER-93516
https://security.netapp.com/advisory/ntap-20241115-0001/