CVE-2023-0342: 
MongoDB Ops Manager vulnerability analysis and mitigation

CVE-2023-0342 is an information disclosure vulnerability affecting MongoDB Ops Manager versions 5.0 prior to 5.0.21 and v6.0 prior to 6.0.12. The vulnerability allows retrieval of sensitive information, specifically the SAML SSL Pem Key File Password, which is stored in plaintext in the application's Diagnostics Archive (Rapid7 Blog, AttackerKB).

The vulnerability exists in MongoDB Ops Manager's Diagnostic Archive feature where sensitive information, specifically the SAML SSL Pem Key File Password, is stored in plaintext. The vulnerability does not include the PEM files themselves, but exposes the password used to access these files (AttackerKB).

The vulnerability allows unauthorized access to sensitive authentication credentials, specifically the SAML SSL Pem Key File Password. This exposure could potentially lead to unauthorized access to protected resources and compromise of SAML-based authentication mechanisms (Rapid7 Blog).

Organizations should upgrade to MongoDB Ops Manager version 5.0.21 or later for v5.0 installations, or version 6.0.12 or later for v6.0 installations (AttackerKB).