Vulnerability Details : CVE-2021-20335
For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager versions prior to and including 4.4.12 triggers a bug where Automation thinks SSL is being turned off, and can disable SSL temporarily for members of the cluster. This issue is temporary and eventually corrects itself after MongoDB Ops Manager instances have finished upgrading to MongoDB Ops Manager 4.4. In addition, customers must be running with clientCertificateMode=OPTIONAL / allowConnectionsWithoutCertificates=true to be impacted*.* Customers upgrading from Ops Manager 4.2.X to 4.2.24 and finally to Ops Manager 4.4.13+ are unaffected by this issue.
Products affected by CVE-2021-20335
- cpe:2.3:a:mongodb:ops_manager:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-20335
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 10 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-20335
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.1
|
MEDIUM | AV:A/AC:L/Au:S/C:P/I:P/A:N |
5.1
|
4.9
|
NIST | |
|
6.7
|
MEDIUM | CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
1.5
|
5.2
|
MongoDB, Inc. | |
|
4.6
|
MEDIUM | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
2.1
|
2.5
|
NIST |
CWE ids for CVE-2021-20335
-
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.Assigned by:
- cna@mongodb.com (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2021-20335
-
https://docs.opsmanager.mongodb.com/v4.2/release-notes/application/#onprem-server-4-2-23
Ops Manager Server Changelog — MongoDB Ops Manager 4.2Vendor Advisory
Jump to