CVE-2021-20335: mongodb inc. mongodb ops manager
Vulnerability summary
CVE-2021-20335 is a medium (CVSS 6.7) vulnerability in mongodb inc. mongodb ops manager. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 2.8% of scored vulnerabilities.
Timeline
- 11-02-2021PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager versions prior to and including 4.4.12 triggers a bug where Automation thinks SSL is being turned off, and can disable SSL temporarily for members of the cluster. This issue is temporary and eventually corrects itself after MongoDB Ops Manager instances have finished upgrading to MongoDB Ops Manager 4.4. In addition, customers must be running with clientCertificateMode=OPTIONAL / allowConnectionsWithoutCertificates=true to be impacted*.* Customers upgrading from Ops Manager 4.2.X to 4.2.24 and finally to Ops Manager 4.4.13+ are unaffected by this issue.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated4.6MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NDiffers
- NVDNIST4.6MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.14%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
0.00 pp
From 0.14% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mongodb1 product
- ops_manager≥ 4.2.0, ≤ 4.2.24
Mongodb inc.1 product
- mongodb ops manager≥ 4.2, ≤ 4.2.24
Ubuntu1 product
- mongodbAll versions (No fix recorded)
3 vendors · 3 products