CVE-2024-7553
HIGH EPSS 17.3%
Published Aug 7, 20241y ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
Published Aug 7, 2024 1y ago
Last Modified Jun 17, 2026 2w ago
Description
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
17.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-284
Affected Products 86
| Vendor | Product | Version | Range |
|---|---|---|---|
| mongodb | mongodb | * | ≥5.0.0 – <5.0.27 |
| microsoft | windows_10_1507 | * | any |
| microsoft | windows_10_1511 | * | any |
| microsoft | windows_10_1607 | * | any |
| microsoft | windows_10_1703 | * | any |
| microsoft | windows_10_1709 | * | any |
| microsoft | windows_10_1803 | * | any |
| microsoft | windows_10_1809 | * | any |
| microsoft | windows_10_1903 | * | any |
| microsoft | windows_10_1909 | * | any |
| microsoft | windows_10_2004 | * | any |
| microsoft | windows_10_20h2 | * | any |
| microsoft | windows_10_21h1 | * | any |
| microsoft | windows_10_21h2 | * | any |
| microsoft | windows_10_22h2 | * | any |
| microsoft | windows_server_2016 | * | any |
| microsoft | windows_server_2019 | * | any |
| mongodb | mongodb | * | ≥6.0.0 – <6.0.16 |
| microsoft | windows_10_1507 | * | any |
| microsoft | windows_10_1511 | * | any |
| microsoft | windows_10_1607 | * | any |
| microsoft | windows_10_1703 | * | any |
| microsoft | windows_10_1709 | * | any |
| microsoft | windows_10_1803 | * | any |
| microsoft | windows_10_1809 | * | any |
| microsoft | windows_10_1903 | * | any |
| microsoft | windows_10_1909 | * | any |
| microsoft | windows_10_2004 | * | any |
| microsoft | windows_10_20h2 | * | any |
| microsoft | windows_10_21h1 | * | any |
| microsoft | windows_10_21h2 | * | any |
| microsoft | windows_10_22h2 | * | any |
| microsoft | windows_server_2016 | * | any |
| microsoft | windows_server_2019 | * | any |
| mongodb | mongodb | * | ≥7.0.0 – <7.0.12 |
| mongodb | mongodb | * | ≥7.3.0 – <7.3.3 |
| microsoft | windows_11 | * | any |
| microsoft | windows_11_21h2 | * | any |
| microsoft | windows_11_22h2 | * | any |
| microsoft | windows_11_23h2 | * | any |
| microsoft | windows_server_2019 | * | any |
| microsoft | windows_server_2022 | * | any |
| mongodb | c_driver | * | <1.26.2 |
| microsoft | windows_10_1507 | * | any |
| microsoft | windows_10_1511 | * | any |
| microsoft | windows_10_1607 | * | any |
| microsoft | windows_10_1703 | * | any |
| microsoft | windows_10_1709 | * | any |
| microsoft | windows_10_1803 | * | any |
| microsoft | windows_10_1809 | * | any |
| microsoft | windows_10_1903 | * | any |
| microsoft | windows_10_1909 | * | any |
| microsoft | windows_10_2004 | * | any |
| microsoft | windows_10_20h2 | * | any |
| microsoft | windows_10_21h1 | * | any |
| microsoft | windows_10_21h2 | * | any |
| microsoft | windows_10_22h2 | * | any |
| microsoft | windows_11 | * | any |
| microsoft | windows_11_21h2 | * | any |
| microsoft | windows_11_22h2 | * | any |
| microsoft | windows_11_23h2 | * | any |
| microsoft | windows_server_2016 | * | any |
| microsoft | windows_server_2019 | * | any |
| microsoft | windows_server_2022 | * | any |
| mongodb | php_driver | * | <1.18.1 |
| microsoft | windows_10_1507 | * | any |
| microsoft | windows_10_1511 | * | any |
| microsoft | windows_10_1607 | * | any |
| microsoft | windows_10_1703 | * | any |
| microsoft | windows_10_1709 | * | any |
| microsoft | windows_10_1803 | * | any |
| microsoft | windows_10_1809 | * | any |
| microsoft | windows_10_1903 | * | any |
| microsoft | windows_10_1909 | * | any |
| microsoft | windows_10_2004 | * | any |
| microsoft | windows_10_20h2 | * | any |
| microsoft | windows_10_21h1 | * | any |
| microsoft | windows_10_21h2 | * | any |
| microsoft | windows_10_22h2 | * | any |
| microsoft | windows_11 | * | any |
| microsoft | windows_11_21h2 | * | any |
| microsoft | windows_11_22h2 | * | any |
| microsoft | windows_11_23h2 | * | any |
| microsoft | windows_server_2016 | * | any |
| microsoft | windows_server_2019 | * | any |
| microsoft | windows_server_2022 | * | any |
References 3
- jira.mongodb.org https://jira.mongodb.org/browse/CDRIVER-5650
- jira.mongodb.org https://jira.mongodb.org/browse/PHPC-2369
- jira.mongodb.org https://jira.mongodb.org/browse/SERVER-93211
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.