Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2024-6375

Missing authorization check may lead to shard key refinement

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degradation of query performance, or to revealing chunk boundaries through timing side channels. This affects MongoDB Server v5.0 versions, prior to 5.0.22, MongoDB Server v6.0 versions, prior to 6.0.11 and MongoDB Server v7.0 versions prior to 7.0.3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB Inc MongoDB Server

Default version status: unaffected

  • 5.0 to < 5.0.22affected
  • 6.0 to < 6.0.11affected
  • 7.0 to < 7.0.3affected

References