CVE-2024-6375: 
MongoDB vulnerability analysis and mitigation

A command for refining a collection shard key in MongoDB is missing an authorization check, identified as CVE-2024-6375. The vulnerability affects MongoDB Server versions 5.0 (prior to 5.0.22), 6.0 (prior to 6.0.11), and 7.0 (prior to 7.0.3). This security issue was discovered and disclosed on July 1, 2024 (MongoDB Jira).

The vulnerability stems from a missing authorization check in the collection shard key refinement command. The CVSS v3.1 base score is rated at 6.5 MEDIUM (NIST) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L. MongoDB's own assessment rates it at 5.4 MEDIUM with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L. The vulnerability is classified under CWE-862 (Missing Authorization) by NIST and CWE-285 (Improper Authorization) by MongoDB (NVD).

The vulnerability can lead to two primary impacts: degradation of query performance and potential exposure of chunk boundaries through timing side channels when the command runs directly on a shard (MongoDB Jira).

The vulnerability can be exploited remotely with low attack complexity and requires no user interaction. However, there are differing assessments regarding privilege requirements, with NIST indicating no privileges required and MongoDB suggesting low privileges are needed (NVD).

The vulnerability has been patched in MongoDB Server versions 5.0.22, 6.0.11, and 7.0.3. Users are advised to upgrade to these or later versions to mitigate the security risk (MongoDB Jira).