CVE-2019-2388: 
MongoDB Ops Manager vulnerability analysis and mitigation

In affected MongoDB Ops Manager versions there is an exposed HTTP route that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance. This vulnerability (CVE-2019-2388) affects MongoDB Inc. MongoDB Ops Manager 4.0 versions 4.0.9, 4.0.10 and MongoDB Ops Manager 4.1 version 4.1.5 (MongoDB Release Notes, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is related to an exposed HTTP route that could lead to unauthorized access to log information (NVD).

If exploited, this vulnerability allows attackers to view specific access logs of a publicly exposed Ops Manager instance, potentially exposing sensitive information contained in these logs (NVD).

The vulnerability is remotely exploitable without requiring authentication. The attack complexity is rated as Low, requiring no privileges or user interaction to exploit (NVD).

MongoDB has addressed this vulnerability in subsequent releases. Users should upgrade their MongoDB Ops Manager installations to versions newer than 4.0.10 for the 4.0 series or newer than 4.1.5 for the 4.1 series (MongoDB Release Notes).