MongoDB Ops Manager Server vulnerabilities

2 CVEs affecting MongoDB Ops Manager Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-4009, published 2023-08-08.

More from MongoDB.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-0342, published 2023-06-09. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0…
• CVE-2023-4009, published 2023-08-08. High severity, CVSS 7.2. EPSS: 0.8% chance of exploitation in the next 30 days. In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the…