Login Request a demo
High severity · published Aug 23, 2023
CVE-2023-1409
If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms…
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in effect, potentially allowing client to establish a TLS connection with the server that supplies any certificate. This issue affect all MongoDB Server v6.3 versions, MongoDB Server v5.0 versions v5.0.0 to v5.0.14 and all MongoDB Server v4.4 versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
MongoDB · MongoDB
4.4.0 before 4.4.23; 5.0.0 through 5.0.14; 6.0.0 before 6.0.7; 6.3.0 through 6.3.2 · source: NVD
Affected product
MO
MongoDB
MongoDB
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-1409
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-1409
Issue Tracking
https://jira.mongodb.org/browse/SERVER-73662
Issue Tracking
https://jira.mongodb.org/browse/SERVER-77028
security.netapp.com
https://security.netapp.com/advisory/ntap-20230921-0007/
More from MongoDB
9.9
CVE-2019-10758
MongoDB mongo-express Remote Code Execution Vulnerability
7.5
CVE-2025-14847
Zlib compressed protocol header length confusion may allow memory read
9.8
CVE-2026-19001
MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names
9.8
CVE-2025-3085
A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate…
9.8
CVE-2024-8654
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour