CVE-2024-6375

CVSS V2 None CVSS V3 None
Description
A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degradation of query performance, or to revealing chunk boundaries through timing side channels. This affects MongoDB Server v5.0 versions, prior to 5.0.22, MongoDB Server v6.0 versions, prior to 6.0.11 and MongoDB Server v7.0 versions prior to 7.0.3.
Overview
  • CVE ID
  • CVE-2024-6375
  • Assigner
  • mongodb
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-07-01T14:40:32.566Z
  • Last Modified Date
  • 2024-07-01T20:47:54.255Z
References
Reference URL Reference Tags
https://jira.mongodb.org/browse/SERVER-79327
History
Created Old Value New Value Data Type Notes
2024-07-02 13:03:43 Added to TrackCVE