CVE-2024-6384: Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server
"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versions prior to 7.3.3
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6384?
CVE-2024-6384 is classified as a medium severity vulnerability due to the potential exposure of sensitive backup files.
Which versions of MongoDB are affected by CVE-2024-6384?
CVE-2024-6384 affects MongoDB Enterprise Server versions before 6.0.16 and versions before 7.0.11.
How do I fix CVE-2024-6384?
To fix CVE-2024-6384, upgrade to MongoDB Enterprise Server version 6.0.16 or later and 7.0.11 or later.
Can underprivileged users exploit CVE-2024-6384?
Yes, underprivileged users may exploit CVE-2024-6384 to download sensitive backup files if they obtain a unique backup identifier.
What is the impact of CVE-2024-6384 on MongoDB users?
The impact of CVE-2024-6384 includes the risk of unauthorized access to potentially sensitive data within 'hot' backup files.