In MongoDB Ops Manager v5.0 before 5.0.22 and v6.0 before 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
mongodb ops manager server |