CVE-2024-1351 json
MongoDB Server may allow successful untrusted connection
published 2024-03-07 2 y ago modified 2026-09-08 2 mo ago also BIT-mongodb-2024-1351 , EUVD-2024-17108
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28.
Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured.
Patch / fix
- bitnami mongodb 5.0.26, 6.0.14, 7.0.7
- mongodb mongodb 4.4.29, 5.0.25, 6.0.14, 7.0.6
- jira.mongodb.org/browse/SERVER-72839 advisory
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.50% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | mongodb | >=4.4.0, <5.0.26 >=6.0.0, <6.0.14 >=7.0.0, <7.0.7 |
5.0.26 6.0.14 7.0.7 |
Affected products
- MongoDB Inc MongoDB Server
- mongodb mongodb
Classification
- Weakness
-
- CWE-295 Improper Certificate Validation
- Technology feeds
References
-
jira.mongodb.org
/browse/SERVER-72839
issue-tracking, patch, vendor-advisory, advisory
-
mongodb.com
/docs/v5.0/release-notes/5.0/#5.0.25---february-28--2024
release-notes, article
-
mongodb.com
/docs/v6.0/release-notes/6.0/#6.0.14---feb-28--2024
release-notes, article
-
mongodb.com
/docs/manual/release-notes/7.0/#7.0.6---feb-28--2024
release-notes, article
-
mongodb.com
/docs/manual/release-notes/4.4/#4.4.29---february-28--2024
release-notes, broken-link, web
-
security.netapp.com
/advisory/ntap-20240524-0010/
third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-1351
web
Sources
- CVE List CVE-2024-1351
- NVD CVE-2024-1351
- OSV BIT-mongodb-2024-1351
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.