CVE-2023-0342 json
MongoDB Ops Manager may disclose sensitive information in Diagnostic Archive
published 2023-06-09 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-12403
- cvss
- 3.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 1
- Metasploit
Summary
MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12
Patch / fix
- MongoDB Inc. MongoDB Ops Manager 5.0.21, 6.0.12
Timeline
- Published
- First public exploit (Metasploit auxiliary/gather/mongodb_ops_manager_diagnostic_archive_info)
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 22 mo ago
Exploit prediction
0.89% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/gather/mongodb_ops_manager_diagnostic_archive_info MongoDB Ops Manager Diagnostic Archive Sensitive Information Retriever metasploit auxiliary, normal rank, 2023-06-09
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected products
- MongoDB Inc. MongoDB Ops Manager
Classification
- Weakness
-
- CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
References
Sources
- CVE List CVE-2023-0342
- NVD CVE-2023-0342
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.