VYPR
← All advisories
High severity7.2NVD Advisory· Published Aug 8, 2023· Updated Jun 17, 2026

CVE-2023-4009

CVE-2023-4009

Description

In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • MongoDB/Ops Manager Server
    cpe:2.3:a:mongodb:ops_manager_server:*:*:*:*:*:*:*:*
    Range: >=5.0.0,<5.0.22
  • MongoDB/MongoDB Ops Managerllm-fuzzy2 versions
    v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17+ 1 more
    • (no CPE)range: v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17
    • (no CPE)range: 6.0

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.