CVE-2020-7927
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2020
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Potential privilege escalation in Ops Manager API
Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 and MongoDB Ops Manager v4.4 versions prior to and including 4.4.2.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
MongoDB Ops Manager
- Vendor
- MongoDB Inc.
- Product
- MongoDB Ops Manager
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 4.2 | affected | custom | Unavailable | 4.2.17 | None listed |
| 4.3 | affected | custom | Unavailable | 4.3.9 | None listed |
| 4.4 | affected | custom | Unavailable | 4.4.2 | None listed |