CVE-2023-4009: mongodb inc. mongodb ops manager Incorrect Use of Privileged APIs
CVSS: 7.2v3.1HighModified
Published 08-08-2023Last modified 13-02-2025
Vulnerability summary
CVE-2023-4009 is a high (CVSS 7.2) Incorrect Use of Privileged APIs vulnerability in mongodb inc. mongodb ops manager. EPSS estimates a 0.76% chance of exploitation in the next 30 days, higher than 54.6% of scored vulnerabilities.
CVSS score
7.2/10
010
High · v3.1 (CVE.org)EPSS score
0.76%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 08-08-2023PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation.
CVSS metrics
2 scores · 2 sources · 1 versionHigh 7.2Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HSourcesAll 2 agree
- NVDNIST7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.76%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
0.00 pp
From 0.76% on 19-09-2026
19-09-202619-10-2026
EPSS score0.76%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-648Incorrect Use of Privileged APIsThe product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
Mongodb1 product
- ops_manager_server≥ 5.0.0, < 5.0.22 | ≥ 6.0.0, < 6.0.17
Mongodb inc.1 product
- mongodb ops manager≥ 6.0, < 6.0.17 | ≥ 5.0, < 5.0.22
2 vendors · 2 products