CVE-2023-4009

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-648 CWE-269

Affected software

Vendor	Product	Versions
MongoDB Inc.	MongoDB Ops Manager	>= 6.0, < 6.0.17; >= 5.0, < 5.0.22

References

Timeline

Published: Aug 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-400906.5In BTM_BleVerifySignature of btm_ble.cc, there is a possible way to bypass signature validation due to side channel information disclosure. CVE-2023-400917.8In onTransact of IncidentService.cpp, there is a possible out of bounds write due to memory corruption. This could lead to local escalation CVE-2023-400925.5In verifyShortcutInfoPackage of ShortcutService.java, there is a possible way to see another user's image due to a confused deputy. This cou CVE-2023-400935.5In multiple files, there is a possible way that trimmed content could be included in PDF output due to a logic error in the code. This could CVE-2023-400947.8In keyguardGoingAway of ActivityTaskManagerService.java, there is a possible lock screen bypass due to a missing permission check. This coul CVE-2023-400957.8In createDontSendToRestrictedAppsBundle of PendingIntentUtils.java, there is a possible background activity launch due to a missing check. T CVE-2023-400967.8In OpRecordAudioMonitor::onFirstRef of AudioRecordClient.cpp, there is a possible way to record audio from the background due to a missing f CVE-2023-400977.8In hasPermissionForActivity of PackageManagerHelper.java, there is a possible URI grant due to improper input validation. This could lead to CVE-2023-400985.5In mOnDone of NotificationConversationInfo.java, there is a possible way to access app notification data of another user due to a logic erro CVE-2023-401007.8In discovery_thread of Dns64Configuration.cpp, there is a possible memory corruption due to a use after free. This could lead to local escal CVE-2023-401015.5In collapse of canonicalize_md.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information CVE-2023-401037.8In multiple locations, there is a possible way to corrupt memory due to a double free. This could lead to local escalation of privilege with