CVE-2024-7553
MongoDB Windows Local File System Escalation
Description
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue
INFO
Published Date :
Aug. 7, 2024, 10:15 a.m.
Last Modified :
Sept. 19, 2024, 8:46 p.m.
Source :
[email protected]
Remotely Exploitable :
No
Impact Score :
5.9
Exploitability Score :
1.8
Affected Products
The following products are affected by CVE-2024-7553
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-7553.
| URL | Resource |
|---|---|
| https://jira.mongodb.org/browse/CDRIVER-5650 | Vendor Advisory |
| https://jira.mongodb.org/browse/PHPC-2369 | Vendor Advisory |
| https://jira.mongodb.org/browse/SERVER-93211 | Vendor Advisory |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-7553 vulnerability anywhere in the article.
-
Cybersecurity News
XStream Security Advisory: Denial-of-Service Vulnerability (CVE-2024-47072)
A high-severity denial-of-service (DoS) vulnerability has been identified in XStream, a popular Java library used for object serialization. This vulnerability, tracked as CVE-2024-47072 with a CVSSv3 ... Read more
-
Cybersecurity News
CLFS Flaw in Windows 11 Allows for Privilege Escalation, PoC Published
A high-severity vulnerability has been discovered in the Common Log File System (CLFS) driver in Windows 11, enabling local users to escalate their privileges. CLFS is responsible for efficiently mana ... Read more
-
Cybersecurity News
Proof-of-Concept Exploit Released for WhatsUp Gold Authentication Bypass (CVE-2024-6670)
Researcher Sina Kheirkhah of the Summoning Team has published the technical details and a proof-of-concept (PoC) exploit for a critical vulnerability, identified as CVE-2024-6670, affecting Progress S ... Read more
-
Cybersecurity News
Exploit for CVE-2024-38054 Released: Elevation of Privilege Flaw in Windows Kernel Streaming WOW Thunk
Security researcher ‘Frost’ has released proof-of-concept exploit code for the CVE-2024-38054 vulnerability, escalating concerns over a recently patched Windows security flaw. This high-severity vulne ... Read more
-
Cybersecurity News
Beyond the Ransom: Inside the Mind of Brain Cipher Ransomware Group
Indonesian government agencies have fallen victim to a large-scale cyberattack orchestrated by the Brain Cipher ransomware group. On June 20, 2024, hackers dealt a severe blow to the country’s critica ... Read more
-
Cybersecurity News
CVE-2024-38810: Spring Security Flaw Leaves Applications Open to Unauthorized Access
A high-severity vulnerability (CVE-2024-38810) has been discovered in Spring Security, potentially allowing unauthorized access to sensitive data within affected applications. The vulnerability impact ... Read more
-
TheCyberThrone
CISA Adds Solarwinds CVE-2024-28986 to KEV Catalog
The U.S.CISA warned of a critical security vulnerability affecting SolarWinds Web Help Desk.This vulnerability, tracked as CVE-2024-28986 with a CVSS 9.8, has been added to CISA’s Known Exploited Vuln ... Read more
-
TheCyberThrone
Palo Alto Networks Fixes Several Vulnerabilities
Palo Alto Networks released four security advisories that address a total of 34 vulnerabilities across various products. The vulnerabilities impact a range of Palo Alto products, notably PAN-OS and Gl ... Read more
-
TheCyberThrone
Zimbra addressed XSS and LFI vulnerabilities
Zimbra Collaboration disclosed three new security vulnerabilities. These flaws, impact Zimbra Collaboration versions 9.0 and 10.0, potentially exposing users to cross-site scripting (XSS) and local fi ... Read more
-
TheCyberThrone
IBM fixes several QRadar vulnerabilities
IBM recently disclosed critical vulnerabilities affecting its QRadar Suite Software and IBM Cloud Pak for Security. On successful exploitation, it could allow attackers to execute arbitrary code remot ... Read more
-
Cybersecurity News
CVE-2024-39091: Critical Vulnerability in MIPC Camera Framework Puts Millions at Risk
Please enable JavaScriptA high-severity vulnerability (CVE-2024-39091, CVSS 8.8) has been discovered in the MIPC camera framework, a widely-used software platform for home security cameras. This vulne ... Read more
-
TheCyberThrone
Windows CLFS bug leads to a DoS condition CVE-2024-6768
Researchers from Fortra come with a warning of a vulnerability in all versions of Windows 10 and 11 that can cause system instability and a denial of service.The vulnerability tracked as CVE-2024-6768 ... Read more
-
TheCyberThrone
FreeBSD Project fixes Critical Vulnerability CVE-2024-7589
The FreeBSD Project disclosed a critical vulnerability in OpenSSH, could allow a determined attacker to execute arbitrary code remotely with root privileges, potentially compromising the entire system ... Read more
-
Cyber Security News
Weekly Cyber Security News Letter – Data Breaches, Vulnerability, Cyber Attack & More
Our Weekly Cybersecurity Newsletter is your personal radar that will help you to surf through the ever-changing digital threat landscape. This analysis, however, is not just a news report but aims to ... Read more
-
TheCyberThrone
TheCyberThrone Security Week In Review – August 10, 2024
Welcome to TheCyberThrone cybersecurity week in review will be posted covering the important security happenings. This review is for the week ending Saturday, August 10, 2024.Google Fixes Android Zero ... Read more
-
TheCyberThrone
AMD Chips get haunted by decade old bug
Researchers have published a report on an older vulnerability in AMD processors that could potentially allow an attacker to disable critical memory protections in the Ryzen and Epyc CPU lines, potenti ... Read more
-
TheCyberThrone
Microsoft Office Zeorday CVE-2024-38200
Microsoft has disclosed the details of an unpatched zero-day in office that could result in unauthorized disclosure of sensitive information to malicious actors.The vulnerability, tracked as CVE-2024- ... Read more
-
TheCyberThrone
HPE Aruba fixes Several Access Points vulnerabilities
HPE Aruba has released security updates to address multiple critical vulnerabilities in its Aruba Access Points running InstantOS and ArubaOS 10 that could potentially allow unauthorized remote attack ... Read more
-
TheCyberThrone
MongoDB fixes High severity vulnerability CVE-2024-7553
MongoDB has released patches for a high-severity vulnerability affecting multiple versions of its server and driver products that could allow a malicious local user to escalate their privileges, poten ... Read more
-
Cyber Security News
MongoDB Vulnerability Allows Attackers to Gain Complete Control of Windows Systems
A critical vulnerability, identified as CVE-2024-7553, has been discovered in MongoDB. It could potentially allow attackers to take complete control of Windows systems. This vulnerability arises from ... Read more
-
TheCyberThrone
Apple fixes Advanced Data Protection flaws with new iOS version release
Apple has released the iOS 17.6.1 update, specifically targets a bug related to Apple’s Advanced Data Protection (ADP) feature. The glitch, which affected a small number of users, made it difficult to ... Read more
-
Cybersecurity News
MongoDB Patches High-Severity Windows Vulnerability (CVE-2024-7553) in Multiple Products
MongoDB, the popular NoSQL database provider, announced the patching of a high-severity vulnerability affecting multiple versions of its server and driver products. The flaw, tracked as CVE-2024-7553 ... Read more
-
TheCyberThrone
Apache Cloudstack fixes CVE-2024-42062 & CVE-2024-42222
Apache CloudStack project has released patches for addressing two critical vulnerabilities, that could allow attackers to gain unauthorized access to sensitive information and compromise the integri ... Read more
-
TheCyberThrone
Jenkins Patches Critical Vulnerability CVE-2024-43044
Jenkins has released an urgent advisory detailing two vulnerabilities, that expose Jenkins instances to arbitrary file read and unauthorized access risks,The critical one of the two vulnerabilities, t ... Read more
The following table lists the changes that have been made to the
CVE-2024-7553 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Sep. 19, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Changed Reference Type https://jira.mongodb.org/browse/CDRIVER-5650 No Types Assigned https://jira.mongodb.org/browse/CDRIVER-5650 Vendor Advisory Changed Reference Type https://jira.mongodb.org/browse/PHPC-2369 No Types Assigned https://jira.mongodb.org/browse/PHPC-2369 Vendor Advisory Changed Reference Type https://jira.mongodb.org/browse/SERVER-93211 No Types Assigned https://jira.mongodb.org/browse/SERVER-93211 Vendor Advisory Added CWE NIST NVD-CWE-noinfo Added CPE Configuration AND OR *cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* versions from (including) 5.0.0 up to (excluding) 5.0.27 OR cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_20h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_21h1:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Added CPE Configuration AND OR *cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* versions from (including) 6.0.0 up to (excluding) 6.0.16 OR cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_20h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_21h1:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Added CPE Configuration AND OR *cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* versions from (including) 7.0.0 up to (excluding) 7.0.12 *cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* versions from (including) 7.3.0 up to (excluding) 7.3.3 OR cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* Added CPE Configuration AND OR *cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:mongodb:*:* versions up to (excluding) 1.26.2 OR cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_20h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_21h1:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* Added CPE Configuration AND OR *cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:* versions up to (excluding) 1.18.1 OR cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_20h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_21h1:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* -
CVE Received by [email protected]
Aug. 07, 2024
Action Type Old Value New Value Added Description Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue Added Reference MongoDB, Inc. https://jira.mongodb.org/browse/PHPC-2369 [No types assigned] Added Reference MongoDB, Inc. https://jira.mongodb.org/browse/SERVER-93211 [No types assigned] Added Reference MongoDB, Inc. https://jira.mongodb.org/browse/CDRIVER-5650 [No types assigned] Added CWE MongoDB, Inc. CWE-284 Added CVSS V3.1 MongoDB, Inc. AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-7553 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-7553
weaknesses.