Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2016-6494

The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these files.

VectorLOCAL

PublishedOct 03, 2016, 18:59

Published Bycve@mitre.org

Base Score

Score5.5

Affected Versions

No affected versions found.

References

http://www.openwall.com/lists/oss-security/2016/07/29/4
http://www.openwall.com/lists/oss-security/2016/07/29/8
http://www.securityfocus.com/bid/92204
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832908
https://bugzilla.redhat.com/show_bug.cgi?id=1362553
https://github.com/mongodb/mongo/commit/035cf2afc04988b22cb67f4ebfd77e9b344cb6e0
https://jira.mongodb.org/browse/SERVER-25335
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MCE2ZLFBNOK3TTWSTXZJQGZVP4EEJDL/

Weakness Type

CWE-200

CVSS Metrics

Base Score

5.5

Vector String

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Base SeverityMedium

Version

3.0

Attack Vector (AV)

LOCAL