Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2019-2390

Code execution on Windows via OpenSSL engine injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14 and MongoDB Server v3.4 prior to 3.4.22.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB Inc. MongoDB Server

Default version status: unaffected

  • 4.0 to < 4.0.11affected
  • 3.6 to < 3.6.14affected
  • 3.4 to < 3.4.22affected

References