9.8

CVE-2024-1351: mongodb inc mongodb server Improper Certificate Validation

CVSS: 9.8v3.1CriticalAnalyzed
AliasesUBUNTU-CVE-2024-1351
Published 07-03-2024Last modified 13-02-2025
Open JSON

Vulnerability summary

CVE-2024-1351 is a critical (CVSS 9.8) Improper Certificate Validation vulnerability in mongodb inc mongodb server. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.5% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
0.50%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 07-03-2024
    PublishedVulnerability first disclosed.
  2. 13-02-2025
    Last modifiedVulnerability information updated.

Description

Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28. Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.50%

Chance of exploitation in the next 30 days

Percentile

42%

Versus all other CVEs

30-day change

0.00 pp

From 0.50% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.50%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Netapp2 products
Mongodb1 product
  • mongodb≥ 4.4.0, < 4.4.29 | ≥ 5.0.0, < 5.0.25 | ≥ 6.0.0, < 6.0.14 | ≥ 7.0.0, < 7.0.6
Mongodb inc1 product
  • mongodb server≥ 7.0, ≤ 7.0.5 | ≥ 6.0, ≤ 6.0.13 | ≥ 5.0, ≤ 5.0.24 | ≥ 4.4, ≤ 4.4.28
Ubuntu1 product
  • mongodbAll versions (No fix recorded)

4 vendors · 5 products

References

8 links