CVE-2024-7553: Accessing Untrusted Directory May Allow Local Privilege Escalation
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1.
Required Configuration:
Only environments with Windows as the underlying operating system is affected by this issue
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7553?
CVE-2024-7553 has a high severity rating due to its potential for local privilege escalation.
How do I fix CVE-2024-7553?
To mitigate CVE-2024-7553, ensure that your MongoDB version is updated to the latest release beyond the affected versions 5.0.27 and 6.0.16.
Which versions of MongoDB are affected by CVE-2024-7553?
CVE-2024-7553 affects MongoDB versions ranging from 5.0.0 to 5.0.27 and from 6.0.0 to 6.0.16, as well as some other specific versions.
Can CVE-2024-7553 be exploited on Windows operating systems?
Yes, CVE-2024-7553 can be exploited on Windows operating systems due to incorrect validation of files from untrusted directories.
Are there any solutions for applications using MongoDB affected by CVE-2024-7553?
Applications using affected versions of MongoDB should upgrade to secure versions and review their file validation mechanisms.