Riskcovery

CVE-2019-2388

Potential exposure of log information in Ops Manager

State
Published
Severity
5.8 Medium
Published
May 13, 2020
Updated
Aug 4, 2024
Reserved
Dec 10, 2018

Read the record on cve.org

Description

In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance. This issue affects: MongoDB Inc. MongoDB Ops Manager 4.0 versions 4.0.9, 4.0.10 and MongoDB Ops Manager 4.1 version 4.1.5.

Scores

CVSSScoreVectorSource
3.15.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:Nmongodb

Weaknesses

  • CWE-425 Direct Request (Forced Browsing)

Affected Products

ProductVersions
MongoDB Ops ManagerMongoDB Inc.
  • 4.0.9Affected
  • 4.0.10Affected
  • 4.1.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.