CVE-2023-0436

The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6.0, 1.6.1, 1.7.0. Please note that this is reported on an EOL version of the product, and users are advised to upgrade to the latest supported version. Required Configuration: DEBUG logging is not enabled by default, and must be configured by the end-user. To check the log-level of the Operator, review the flags passed in your deployment configuration (eg. https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 )

CVSS v3 4.5 MEDIUM

4.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/mongodb/mongodb-atlas-kubernetes/releases/tag/v1.7.1	Release Notes Vendor Advisory
https://github.com/mongodb/mongodb-atlas-kubernetes/releases/tag/v1.7.1	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mongodb:atlas_kubernetes_operator::::::::
	cpe:2.3:a:mongodb:atlas_kubernetes_operator:1.5.0:::::::*

History

No history.

Information

Published : 2023-11-07 12:15

Updated : 2024-11-21 07:37

NVD link : CVE-2023-0436

Mitre link : CVE-2023-0436

CVE.ORG link : CVE-2023-0436

JSON object : View

Products Affected

mongodb

atlas_kubernetes_operator

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2023-0436", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-11-07T12:15:08.067", "references": [{"url": "https://github.com/mongodb/mongodb-atlas-kubernetes/releases/tag/v1.7.1", "tags": ["Release Notes", "Vendor Advisory"], "source": "cna@mongodb.com"}, {"url": "https://github.com/mongodb/mongodb-atlas-kubernetes/releases/tag/v1.7.1", "tags": ["Release Notes", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cna@mongodb.com", "description": [{"lang": "en", "value": "CWE-532"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6.0, 1.6.1, 1.7.0.\n\nPlease note that this is reported on an EOL version of the product, and users are advised to upgrade to the latest supported version.\nRequired Configuration:\u00a0\n\nDEBUG logging is not enabled by default, and must be configured by the end-user. To check the log-level of the Operator, review the flags passed in your deployment configuration (eg. https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 )\n\n"}, {"lang": "es", "value": "Las versiones afectadas de MongoDB Atlas Kubernetes Operator pueden imprimir informaci\u00f3n confidencial, como claves de cuenta de servicio de GCP y secretos de integraci\u00f3n de API, mientras el registro en modo DEBUG est\u00e1 habilitado. Este problema afecta a las versiones de MongoDB Atlas Kubernetes Operador: 1.5.0, 1.6.0, 1.6.1, 1.7.0. Tenga en cuenta que esto se informa en una versi\u00f3n EOL del producto y se recomienda a los usuarios que actualicen a la \u00faltima versi\u00f3n compatible. Configuraci\u00f3n requerida: el registro DEBUG no est\u00e1 habilitado de forma predeterminada y debe configurarlo el usuario final. Para verificar el nivel de registro del Operador, revise los indicadores pasados en su configuraci\u00f3n de implementaci\u00f3n (por ejemplo, https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27)"}], "lastModified": "2024-11-21T07:37:10.633", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mongodb:atlas_kubernetes_operator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC863EEC-521C-492B-9391-1F05490E6772", "versionEndExcluding": "1.7.1", "versionStartIncluding": "1.6.0"}, {"criteria": "cpe:2.3:a:mongodb:atlas_kubernetes_operator:1.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "252CFC4D-4CF4-439D-935B-5D7A16E17FAF"}], "operator": "OR"}]}], "sourceIdentifier": "cna@mongodb.com"}