Description (CNA)
When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of identifying users, a remote party with network access to the listener can therefore establish a session and read the MongoDB data exposed through the connector.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| MongoDB / BI Connector | affected 0 before 2.14.31 |
CWE
CWE-295
References
ADP enrichment
No English description supplied.
No references supplied.