UpHeron
All vulnerabilities

Servers and applications

CVE-2019-2390

An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14 and MongoDB Server v3.4 prior to 3.4.22.

Severity
High 7.8
Published
30 Aug 2019
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.4.22, 3.6.14, 4.0.11
Sources
NVD

Affected software

SoftwareAffected versions
MongoDBServers and applications · cpe:a:mongodb:mongodb
  • From 3.4.0 before 3.4.22
  • From 3.6.0 before 3.6.14
  • From 4.0.0 before 4.0.11

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-2390
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-2390