7.8

CVE-2024-7553: mongodb inc mongodb c driver Improper Access Control

CVSS: 7.8v3.1HighAnalyzed
AliasesUBUNTU-CVE-2024-7553
Published 07-08-2024Last modified 07-08-2024
Open JSON

Vulnerability summary

CVE-2024-7553 is a high (CVSS 7.8) Improper Access Control vulnerability in mongodb inc mongodb c driver. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.6% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (NVD)
EPSS score
0.26%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 07-08-2024
    PublishedVulnerability first disclosed.
  2. 07-08-2024
    Last modifiedVulnerability information updated.

Description

Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.26%

Chance of exploitation in the next 30 days

Percentile

17%

Versus all other CVEs

30-day change

0.00 pp

From 0.26% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.26%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Mongodb3 products
  • c_driver< 1.26.2
  • mongodb≥ 5.0.0, < 5.0.27 | ≥ 6.0.0, < 6.0.16 | ≥ 7.0.0, < 7.0.12 | ≥ 7.3.0, < 7.3.3
  • php_driver< 1.18.1
Mongodb inc3 products
Ubuntu3 products
  • mongo-c-driverAll versions (No fix recorded)
  • mongodbAll versions (No fix recorded)
  • php-mongodbAll versions (No fix recorded)

3 vendors · 9 products

References

5 links