CVE-2023-0342: MongoDB Ops Manager may disclose sensitive information in Diagnostic Archive
Published Jun 9, 2023
·Updated
MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12
Affected Software
2 affected components
MongoDB Ops Manager Server>=5.0.0<5.0.21
MongoDB Ops Manager Server>=6.0.0<6.0.12
Event History
Jun 9, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2023-0342.
2
What is the severity of CVE-2023-0342?
The severity of CVE-2023-0342 is medium with a CVSS score of 5.3.
3
Which versions of MongoDB Ops Manager are affected?
MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12 are affected.
4
What is the issue with the PEM key file password app settings?
MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings.
5
Does the vulnerability affect the actual PEM files included in the archives?
No, the archives do not include the PEM files themselves.
6
How can I fix this vulnerability?
Upgrade MongoDB Ops Manager to version 5.0.21 or higher for v5.0, or version 6.0.12 or higher for v6.0.