CVE-2019-2386: Authorization session conflation
First published: Tue Aug 06 2019(Updated: )
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects MongoDB Server v4.0 versions prior to 4.0.9; MongoDB Server v3.6 versions prior to 3.6.13 and MongoDB Server v3.4 versions prior to 3.4.22. Workaround: After deleting one or more users, restart any nodes which may have had active user authorization sessions. Refrain from creating user accounts with the same name as previously deleted accounts.
Credit: cna@mongodb.com cna@mongodb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MongoDB MongoDB | >=3.4.0<3.4.22 | |
| MongoDB MongoDB | >=3.6.0<3.6.13 | |
| MongoDB MongoDB | >=4.0.0<4.0.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-2386?
CVE-2019-2386 is a vulnerability in MongoDB Server that allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones.
Which versions of MongoDB Server are affected by CVE-2019-2386?
Versions of MongoDB Server v3.4.0 to v3.4.22, v3.6.0 to v3.6.13, and v4.0.0 to v4.0.9 are affected by CVE-2019-2386.
What is the severity of CVE-2019-2386?
The severity of CVE-2019-2386 is high, with a CVSS score of 7.1.
How does CVE-2019-2386 affect MongoDB Server?
CVE-2019-2386 allows an authenticated user's session to persist and become conflated with new accounts if those accounts reuse the names of deleted ones.
How can CVE-2019-2386 be mitigated?
To mitigate CVE-2019-2386, users should update to the latest version of MongoDB Server that includes a fix for this vulnerability.
- agent/weakness
- agent/references
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/first-publish-date
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/author
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/mongodb
- canonical/mongodb mongodb
- version/mongodb mongodb/3.4.0
- version/mongodb mongodb/3.6.0
- version/mongodb mongodb/4.0.0