Medium severity · published Nov 23, 2020
CVE-2020-7927
Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege
6.5
CVSS
1%
EPSS
No
On KEV
Description
Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 and MongoDB Ops Manager v4.4 versions prior to and including 4.4.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OM
Ops Manager · Mongodb
4.2.0 through 4.2.17; 4.3.0 through 4.3.9; 4.4.0 through 4.4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-7927
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-7927
www.mongodb.com
https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-4.4.3
More from Ops Manager
7.2
CVE-2026-8431
Ops Manager RCE via webhook body
6.5
CVE-2026-87109
Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings
5.3
CVE-2026-87110
Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints
5.3
CVE-2019-2388
In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance
4.6
CVE-2021-20335
For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB…