« Volver al listado

CVE-2023-0436

Estado: ModificadaAlta (7.5)—

The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6.0, 1.6.1, 1.7.0.

Please note that this is reported on an EOL version of the product, and users are advised to upgrade to the latest supported version. Required Configuration:

DEBUG logging is not enabled by default, and must be configured by the end-user.

Leer descripción completaMostrar menos

To check the log-level of the Operator, review the flags passed in your deployment configuration (eg. https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 )

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mongodb — Atlas Kubernetes Operator

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-0436",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@mongodb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cna@mongodb.com",
      "affectedData": [
        {
          "vendor": "MongoDB Inc",
          "product": "MongoDB Atlas Kubernetes Operator",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.0",
              "versionType": "custom",
              "lessThanOrEqual": "1.7.0"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-11-07T12:15:08.067",
  "references": [
    {
      "url": "https://github.com/mongodb/mongodb-atlas-kubernetes/releases/tag/v1.7.1",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cna@mongodb.com"
    },
    {
      "url": "https://github.com/mongodb/mongodb-atlas-kubernetes/releases/tag/v1.7.1",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@mongodb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6.0, 1.6.1, 1.7.0.\n\nPlease note that this is reported on an EOL version of the product, and users are advised to upgrade to the latest supported version.\nRequired Configuration: \n\nDEBUG logging is not enabled by default, and must be configured by the end-user. To check the log-level of the Operator, review the flags passed in your deployment configuration (eg.  https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 )\n\n"
    },
    {
      "lang": "es",
      "value": "Las versiones afectadas de MongoDB Atlas Kubernetes Operator pueden imprimir información confidencial, como claves de cuenta de servicio de GCP y secretos de integración de API, mientras el registro en modo DEBUG está habilitado. Este problema afecta a las versiones de MongoDB Atlas Kubernetes Operador: 1.5.0, 1.6.0, 1.6.1, 1.7.0. Tenga en cuenta que esto se informa en una versión EOL del producto y se recomienda a los usuarios que actualicen a la última versión compatible. Configuración requerida: el registro DEBUG no está habilitado de forma predeterminada y debe configurarlo el usuario final. Para verificar el nivel de registro del Operador, revise los indicadores pasados en su configuración de implementación (por ejemplo,  https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27)"
    }
  ],
  "lastModified": "2026-06-17T05:25:32.920",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mongodb:atlas_kubernetes_operator:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC863EEC-521C-492B-9391-1F05490E6772",
              "versionEndExcluding": "1.7.1",
              "versionStartIncluding": "1.6.0"
            },
            {
              "criteria": "cpe:2.3:a:mongodb:atlas_kubernetes_operator:1.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "252CFC4D-4CF4-439D-935B-5D7A16E17FAF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@mongodb.com"
}