{"schemaVersion":3,"id":"CVE-2024-1351","aliases":["UBUNTU-CVE-2024-1351"],"status":"published","duplicateOf":null,"title":null,"description":"Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections  that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28.\n\nRequired Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured.","dates":{"published":"2024-03-07T16:10:19.597Z","modified":"2025-02-13T17:27:37.200Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.005,"percentile":0.41541,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.005},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00492,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.005,"percentile":0.41541}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00492,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.005,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.005,"percentile":0.41541}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-295","name":"Improper Certificate Validation","description":"The product does not validate, or incorrectly validates, a certificate.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/295.html"}],"affected":[{"vendor":"ubuntu","product":"mongodb","name":"mongodb","label":"mongodb","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/mongodb","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"mongodb inc","product":"mongodb server","name":"MongoDB Server","label":"mongodb server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 7.0, ≤ 7.0.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0, ≤ 6.0.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0, ≤ 5.0.24","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.4, ≤ 4.4.28","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.0, ≤ 7.0.5 | ≥ 6.0, ≤ 6.0.13 | ≥ 5.0, ≤ 5.0.24 | ≥ 4.4, ≤ 4.4.28","eol":null,"hubHref":"/vendor/mongodb_inc/mongodb_server"},{"vendor":"mongodb","product":"mongodb","name":"mongodb","label":"mongodb","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.4.0, < 4.4.29","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0.0, < 5.0.25","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0.0, < 6.0.14","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.0.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.4.0, < 4.4.29 | ≥ 5.0.0, < 5.0.25 | ≥ 6.0.0, < 6.0.14 | ≥ 7.0.0, < 7.0.6","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"mongodb","label":"MongoDB Server","category":"database"}},"hubHref":"/vendor/mongodb/mongodb"},{"vendor":"netapp","product":"astra_control_center","name":"astra control center","label":"astra_control_center","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/netapp/astra_control_center"},{"vendor":"netapp","product":"ontap_tools","name":"ontap tools","label":"ontap_tools","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"10","noFixRecorded":false,"fixedIn":null}],"versionsText":"10","eol":null,"hubHref":"/vendor/netapp/ontap_tools"}],"affectedCount":5,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://jira.mongodb.org/browse/SERVER-72839","label":"jira.mongodb.org/browse/SERVER-72839","hostname":"jira.mongodb.org","tags":["REPORT","Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.mongodb.com/docs/v5.0/release-notes/5.0/#5.0.25---february-28--2024","label":"www.mongodb.com/docs/v5.0/release-notes/5.0/","hostname":"www.mongodb.com","tags":["Release Notes","REPORT"]},{"url":"https://www.mongodb.com/docs/v6.0/release-notes/6.0/#6.0.14---feb-28--2024","label":"www.mongodb.com/docs/v6.0/release-notes/6.0/","hostname":"www.mongodb.com","tags":["Release Notes","REPORT"]},{"url":"https://www.mongodb.com/docs/manual/release-notes/7.0/#7.0.6---feb-28--2024","label":"www.mongodb.com/docs/manual/release-notes/7.0/","hostname":"www.mongodb.com","tags":["Release Notes","REPORT"]},{"url":"https://www.mongodb.com/docs/manual/release-notes/4.4/#4.4.29---february-28--2024","label":"www.mongodb.com/docs/manual/release-notes/4.4/","hostname":"www.mongodb.com","tags":["Release Notes","REPORT","Broken Link"]},{"url":"https://security.netapp.com/advisory/ntap-20240524-0010/","label":"security.netapp.com/advisory/ntap-20240524-0010/","hostname":"security.netapp.com","tags":["Third Party Advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-1351","label":"ubuntu.com/security/CVE-2024-1351","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1351","label":"www.cve.org/CVERecord?id=CVE-2024-1351","hostname":"www.cve.org","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2024-03-07T16:10:19.597Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-02-13T17:27:37.200Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T13:22:16.743Z","stale":false,"partial":false}}