High severity8.2NVD Advisory· Published Aug 30, 2019· Updated Jun 17, 2026

CVE-2019-2390

Description

An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14 and MongoDB Server v3.4 prior to 3.4.22.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

MongoDB/MongoDB Servercpe-rescue
Range: 4.0
MongoDB/Serverllm-fuzzy
Range: <4.0.11, <3.6.14, <3.4.22
MongoDB/MongoDB
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
Range: >=3.4.0,<3.4.22

Patches

Vulnerability mechanics

References

jira.mongodb.org/browse/SERVER-42233nvdIssue TrackingVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.533
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000