Ops Manager
Monthly
Command injection in MongoDB Ops Manager (all 7.0 versions and 8.0.22 and prior) lets an administrative user with webhook-configuration rights achieve arbitrary command execution by embedding malicious FreeMarker template syntax in a webhook and then triggering it. The flaw is vendor-reported (MongoDB) with a patch in 8.0.23; there is no public exploit identified at time of analysis and EPSS is very low (0.05%), consistent with SSVC's 'exploitation: none' rating despite the total technical impact.
For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager versions. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.
Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege.2 versions prior to and including 4.2.17, MongoDB. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Command injection in MongoDB Ops Manager (all 7.0 versions and 8.0.22 and prior) lets an administrative user with webhook-configuration rights achieve arbitrary command execution by embedding malicious FreeMarker template syntax in a webhook and then triggering it. The flaw is vendor-reported (MongoDB) with a patch in 8.0.23; there is no public exploit identified at time of analysis and EPSS is very low (0.05%), consistent with SSVC's 'exploitation: none' rating despite the total technical impact.
For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager versions. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.
Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege.2 versions prior to and including 4.2.17, MongoDB. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.