CVE-2016-6494: Infoleak
It was found that MongoDB creates a world-readable .dbshell history file in a user's directory:
The mongodb client doesn't store authentication commands, but there's still information leakage, though, even if only about database and collection names, or data structure.
As for data itself, the history could also contain sensitive information; for instance, if usernames for some other service were stored in a mongo collection, the history could contain lines like:
db.users.find({user:"foo"})
or even:
db.users.update({user:"foo"},{$set:{password:"OhComeOnNow"}})
Upstream bug (closed as "Works as Designed"):
https://jira.mongodb.org/browse/SERVER-25335
CVE request:
http://seclists.org/oss-sec/2016/q3/199
Other sources
The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these files.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6494?
CVE-2016-6494 is rated as a medium severity vulnerability due to potential information leakage from a world-readable .dbshell history file.
How do I fix CVE-2016-6494?
To fix CVE-2016-6494, you should upgrade to MongoDB versions 2.6.12-3, 3.2.11-1, or 2.4.10-5+deb8u1 where the issue is resolved.
Who is affected by CVE-2016-6494?
CVE-2016-6494 affects users of specific MongoDB versions that create world-readable .dbshell history files, potentially exposing sensitive information.
What versions of MongoDB are vulnerable to CVE-2016-6494?
MongoDB versions prior to 3.0.15 are vulnerable to CVE-2016-6494, particularly those in the 2.x series.
Is there a workaround for CVE-2016-6494 until I can upgrade?
A temporary workaround for CVE-2016-6494 is to change the permissions of the .dbshell file to restrict access, though upgrading is recommended.