CVE-2024-1351

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Mar 7, 2024
Updated: Mar 8, 2024
CWE ID 295

Summary

CVE-2024-1351 is a vulnerability that affects MongoDB Server versions prior to and including 7.0.5, 6.0.13, 5.0.24, and 4.4.28. Under certain configurations, the server may skip peer certificate validation, allowing untrusted connections to succeed. This can reduce the security guarantees provided by TLS and result in open connections that should have been closed due to failing certificate validation. To remediate this vulnerability, it is necessary to configure the server process with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and a net.tls.CAFile configured. The potential danger this vulnerability poses to organizations is high, as it can compromise the integrity and confidentiality of data transmitted over untrusted connections, potentially leading to unauthorized access or data breaches.

Note: The summary is based on the given information and does not include any analysis or opinions about the severity of the vulnerability.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-1351 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options