Search/CVE-2020-7922
● CVE — Medium

CVE-2020-7922

VendormongodbProductmongodb enterprise kubernetes operatorDiscoveredApr 9, 2020UpdatedNov 21, 2024

X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates are unaffected. This issue affects MongoDB Enterprise Kubernetes Operator version 1.0, MongoDB Enterprise Kubernetes Operator version 1.1, MongoDB Enterprise Kubernetes Operator version 1.2 versions prior to 1.2.4, MongoDB Enterprise Kubernetes Operator version 1.3 versions prior to 1.3.1, 1.2, 1.4 versions prior to 1.4.4.

CVSS v3.1
6.4 MEDIUM
EPSS
0.67%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
CVSS v3.1 Detail
Attack VectorADJACENT
Attack ComplexityHIGH
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityNONE
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Connections
2 relationships
Timeline
disclosure → media coverage
Apr 9, 2020
Disclosure — published as a CVE record. · last revised by NVD Nov 21, 2024