CVE-2024-1351

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1351
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28. Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://jira.mongodb.org/browse/SERVER-72839 Patch Vendor Advisory Issue Tracking
https://security.netapp.com/advisory/ntap-20240524-0010/ Third Party Advisory
https://www.mongodb.com/docs/manual/release-notes/4.4/#4.4.29---february-28--2024 Broken Link
https://www.mongodb.com/docs/manual/release-notes/7.0/#7.0.6---feb-28--2024 Release Notes
https://www.mongodb.com/docs/v5.0/release-notes/5.0/#5.0.25---february-28--2024 Release Notes
https://www.mongodb.com/docs/v6.0/release-notes/6.0/#6.0.14---feb-28--2024 Release Notes
https://jira.mongodb.org/browse/SERVER-72839 Patch Vendor Advisory Issue Tracking
https://security.netapp.com/advisory/ntap-20240524-0010/ Third Party Advisory
https://www.mongodb.com/docs/manual/release-notes/4.4/#4.4.29---february-28--2024 Broken Link
https://www.mongodb.com/docs/manual/release-notes/7.0/#7.0.6---feb-28--2024 Release Notes
https://www.mongodb.com/docs/v5.0/release-notes/5.0/#5.0.25---february-28--2024 Release Notes
https://www.mongodb.com/docs/v6.0/release-notes/6.0/#6.0.14---feb-28--2024 Release Notes
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:netapp:astra_control_center:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*
History

11 Mar 2025, 16:56

Type Values Removed Values Added
References () https://jira.mongodb.org/browse/SERVER-72839 - () https://jira.mongodb.org/browse/SERVER-72839 - Patch, Vendor Advisory, Issue Tracking
References () https://security.netapp.com/advisory/ntap-20240524-0010/ - () https://security.netapp.com/advisory/ntap-20240524-0010/ - Third Party Advisory
References () https://www.mongodb.com/docs/manual/release-notes/4.4/#4.4.29---february-28--2024 - () https://www.mongodb.com/docs/manual/release-notes/4.4/#4.4.29---february-28--2024 - Broken Link
References () https://www.mongodb.com/docs/manual/release-notes/7.0/#7.0.6---feb-28--2024 - () https://www.mongodb.com/docs/manual/release-notes/7.0/#7.0.6---feb-28--2024 - Release Notes
References () https://www.mongodb.com/docs/v5.0/release-notes/5.0/#5.0.25---february-28--2024 - () https://www.mongodb.com/docs/v5.0/release-notes/5.0/#5.0.25---february-28--2024 - Release Notes
References () https://www.mongodb.com/docs/v6.0/release-notes/6.0/#6.0.14---feb-28--2024 - () https://www.mongodb.com/docs/v6.0/release-notes/6.0/#6.0.14---feb-28--2024 - Release Notes
First Time Mongodb
Netapp
Mongodb mongodb
Netapp ontap Tools
Netapp astra Control Center
CPE cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:astra_control_center:-:*:*:*:*:*:*:*

13 Feb 2025, 18:16

Type Values Removed Values Added
Summary (en) Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28. Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured. (en) Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28. Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured.

21 Nov 2024, 08:50

Type Values Removed Values Added
References () https://jira.mongodb.org/browse/SERVER-72839 - () https://jira.mongodb.org/browse/SERVER-72839 -
References () https://security.netapp.com/advisory/ntap-20240524-0010/ - () https://security.netapp.com/advisory/ntap-20240524-0010/ -
References () https://www.mongodb.com/docs/manual/release-notes/4.4/#4.4.29---february-28--2024 - () https://www.mongodb.com/docs/manual/release-notes/4.4/#4.4.29---february-28--2024 -
References () https://www.mongodb.com/docs/manual/release-notes/7.0/#7.0.6---feb-28--2024 - () https://www.mongodb.com/docs/manual/release-notes/7.0/#7.0.6---feb-28--2024 -
References () https://www.mongodb.com/docs/v5.0/release-notes/5.0/#5.0.25---february-28--2024 - () https://www.mongodb.com/docs/v5.0/release-notes/5.0/#5.0.25---february-28--2024 -
References () https://www.mongodb.com/docs/v6.0/release-notes/6.0/#6.0.14---feb-28--2024 - () https://www.mongodb.com/docs/v6.0/release-notes/6.0/#6.0.14---feb-28--2024 -

10 Jun 2024, 17:16

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240524-0010/ -

08 Mar 2024, 14:02

Type Values Removed Values Added
Summary
  • (es) Bajo ciertas configuraciones de --tlsCAFile y tls.CAFile, el servidor MongoDB puede omitir la validación de certificados de pares, lo que puede resultar en conexiones que no son de confianza para tener éxito. Esto puede reducir efectivamente las garantías de seguridad proporcionadas por TLS y abrir conexiones que deberían haberse cerrado debido a una validación fallida del certificado. Este problema afecta a las versiones de MongoDB Server v7.0 anteriores a 7.0.5 incluida, a las versiones de MongoDB Server v6.0 anteriores a 6.0.13 incluida, a las versiones de MongoDB Server v5.0 anteriores a 5.0.24 incluida y a MongoDB Server v4.4 Versiones anteriores a la 4.4.28 incluida. Configuración requerida: un proceso de servidor permitirá que las conexiones entrantes omitan la validación del certificado de pares si el proceso del servidor se inició con TLS habilitado (net.tls.mode configurado en enableTLS, preferTLS o requireTLS) y sin un archivo net.tls.CAFile configurado.

07 Mar 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-07 17:15

Updated : 2025-03-11 16:56

NVD link : CVE-2024-1351

Mitre link : CVE-2024-1351

CVE.ORG link : CVE-2024-1351

JSON object : View

Products Affected

mongodb

  • mongodb

netapp

  • astra_control_center
  • ontap_tools
CWE
CWE-295

Improper Certificate Validation