CVE-2023-0436

{"id": "CVE-2023-0436", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}]}, "published": "2023-11-07T12:15:08.067", "references": [{"url": "https://github.com/mongodb/mongodb-atlas-kubernetes/releases/tag/v1.7.1", "tags": ["Release Notes", "Vendor Advisory"], "source": "cna@mongodb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-532"}]}, {"type": "Secondary", "source": "cna@mongodb.com", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6.0, 1.6.1, 1.7.0.\n\nPlease note that this is reported on an EOL version of the product, and users are advised to upgrade to the latest supported version.\nRequired Configuration:\u00a0\n\nDEBUG logging is not enabled by default, and must be configured by the end-user. To check the log-level of the Operator, review the flags passed in your deployment configuration (eg. https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 )\n\n"}, {"lang": "es", "value": "Las versiones afectadas de MongoDB Atlas Kubernetes Operator pueden imprimir informaci\u00f3n confidencial, como claves de cuenta de servicio de GCP y secretos de integraci\u00f3n de API, mientras el registro en modo DEBUG est\u00e1 habilitado. Este problema afecta a las versiones de MongoDB Atlas Kubernetes Operador: 1.5.0, 1.6.0, 1.6.1, 1.7.0. Tenga en cuenta que esto se informa en una versi\u00f3n EOL del producto y se recomienda a los usuarios que actualicen a la \u00faltima versi\u00f3n compatible. Configuraci\u00f3n requerida: el registro DEBUG no est\u00e1 habilitado de forma predeterminada y debe configurarlo el usuario final. Para verificar el nivel de registro del Operador, revise los indicadores pasados en su configuraci\u00f3n de implementaci\u00f3n (por ejemplo, https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27)"}], "lastModified": "2023-11-14T19:56:05.983", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mongodb:atlas_kubernetes_operator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC863EEC-521C-492B-9391-1F05490E6772", "versionEndExcluding": "1.7.1", "versionStartIncluding": "1.6.0"}, {"criteria": "cpe:2.3:a:mongodb:atlas_kubernetes_operator:1.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "252CFC4D-4CF4-439D-935B-5D7A16E17FAF"}], "operator": "OR"}]}], "sourceIdentifier": "cna@mongodb.com"}