CVE-2019-2386: Authorization session conflation
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects MongoDB Server v4.0 versions prior to 4.0.9; MongoDB Server v3.6 versions prior to 3.6.13 and MongoDB Server v3.4 versions prior to 3.4.22.
Workaround: After deleting one or more users, restart any nodes which may have had active user authorization sessions.
Refrain from creating user accounts with the same name as previously deleted accounts.
Other sources
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.9; v3.6 versions prior to 3.6.13; v3.4 versions prior to 3.4.22.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-2386?
CVE-2019-2386 is a vulnerability in MongoDB Server that allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones.
Which versions of MongoDB Server are affected by CVE-2019-2386?
Versions of MongoDB Server v3.4.0 to v3.4.22, v3.6.0 to v3.6.13, and v4.0.0 to v4.0.9 are affected by CVE-2019-2386.
What is the severity of CVE-2019-2386?
The severity of CVE-2019-2386 is high, with a CVSS score of 7.1.
How does CVE-2019-2386 affect MongoDB Server?
CVE-2019-2386 allows an authenticated user's session to persist and become conflated with new accounts if those accounts reuse the names of deleted ones.
How can CVE-2019-2386 be mitigated?
To mitigate CVE-2019-2386, users should update to the latest version of MongoDB Server that includes a fix for this vulnerability.