CVE-2023-1409

If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in effect, potentially allowing client to establish a TLS connection with the server that supplies any certificate. This issue affect all MongoDB Server v6.3 versions, MongoDB Server v5.0 versions v5.0.0 to v5.0.14 and all MongoDB Server v4.4 versions.

Affected products

Mongodb Server, Mongodb

Mongodb

< 4.4.23, 5.0.14, 6.0.7, 6.3.2

Fix

Available

CVSS 3.1

7.5 HIGH

EPSS

0.4% (29th percentile)

Weakness

CWE-295

NVD status

Modified

Published

2023-08-23

No exploit for CVE-2023-1409 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.