CVE-2024-1351
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28. Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured.
- Affected products
- Alt Linux, Mongodb Server, Mongodb, Red Os
- Mongodb
- < 4.4.29, 5.0.25, 6.0.14, 7.0.6
- Fix
- Available
- CVSS 3.1
- 9.8 CRITICAL
- EPSS
- 0.5% (40th percentile)
- Weakness
- CWE-295
- NVD status
- Analyzed
- Published
- 2024-03-07
No indexed exploits for CVE-2024-1351 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2024-1351 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.