CVE-2020-7922

MEDIUM Year: 2020
CVSS v3 Score
6.5
Medium
CVSS v2 Score
4.0
Medium
Weakness Type
CWE-295
View all →

Vulnerability Description

X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates are unaffected. This issue affects MongoDB Enterprise Kubernetes Operator version 1.0, MongoDB Enterprise Kubernetes Operator version 1.1, MongoDB Enterprise Kubernetes Operator version 1.2 versions prior to 1.2.4, MongoDB Enterprise Kubernetes Operator version 1.3 versions prior to 1.3.1, 1.2, 1.4 versions prior to 1.4.4.

Related Vulnerabilities

CVE-2007-5967

MEDIUM
CVSS:6.5(Medium)

A flaw in Mozilla's embedded certificate code might allow web sites to install root certificates on devices without user approval.

CWE-2952007

CVE-2011-2669

MEDIUM
CVSS:6.5(Medium)

Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates.

CWE-2952011

CVE-2013-6662

MEDIUM
CVSS:6.5(Medium)

Google Chrome caches TLS sessions before certificate validation occurs.

CWE-2952013

CVE-2014-3250

MEDIUM
CVSS:6.5(Medium)

The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certif...

CWE-2952014

CVE-2017-18479

MEDIUM
CVSS:6.5(Medium)

In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).

CWE-2952017

CVE-2017-2629

MEDIUM
CVSS:6.5(Medium)

curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or fa...

CWE-2952017