CVE-2019-2390

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14 and MongoDB Server v3.4 prior to 3.4.22.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

VendorProductVersions
MongoDB Inc.MongoDB Server>= 4.0, < 4.0.11; >= 3.6, < 3.6.14; >= 3.4, < 3.4.22

References

Timeline

Published
Aug 30, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-23915.4Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviouCVE-2019-23926.5A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use the $mod operatoCVE-2019-23936.5A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use $lookup and collCVE-2019-23955.4Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). The supported version CVE-2019-23964.7Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Messages). Supported versions that CVE-2019-23974.4Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. The supported version thCVE-2019-23984.3Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Deployment). Supported versions that CVE-2019-23996.5Vulnerability in the Oracle Communications Diameter Signaling Router (DSR) component of Oracle Communications Applications (subcomponent: SeCVE-2019-24008.2Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: User Registration). Supported versions that are affecCVE-2019-24018.1Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. The supported version thCVE-2019-24027.7Vulnerability in the Oracle Hospitality Simphony component of Oracle Food and Beverage Applications. The supported version that is affected CVE-2019-24036.5Vulnerability in the Oracle Hospitality Simphony component of Oracle Food and Beverage Applications. The supported version that is affected
CVE-2019-2390: High severity, CVSS 7.8 | Vulnix