CVE-2023-1409

CVSS V2 None CVSS V3 None

Description

If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in effect, potentially allowing client to establish a TLS connection with the server that supplies any certificate. This issue affect all MongoDB Server v6.3 versions, MongoDB Server v5.0 versions v5.0.0 to v5.0.14 and all MongoDB Server v4.4 versions.

Overview

CVE ID
CVE-2023-1409

Assigner
mongodb

Vulnerability Status
PUBLISHED

Published Version
2023-08-23T15:21:43.150Z

Last Modified Date
2023-08-23T15:21:43.150Z

Weakness Enumerations

CWE	URL
CWE-295	http://cwe.mitre.org/data/definitions/295.html

References

Reference URL	Reference Tags
https://jira.mongodb.org/browse/SERVER-73662
https://jira.mongodb.org/browse/SERVER-77028
https://security.netapp.com/advisory/ntap-20230921-0007/

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-1409
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1409

History

Created	Old Value	New Value	Data Type	Notes
2024-06-25 08:43:46				Added to TrackCVE