Read the docs
TI-2019-01948 Aliases CVE-2019-2388GHSA-5rrm-4j7m-q4w8

Potential exposure of log information in Ops Manager

Priority LOW 28CWE-425Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-425.

Summary

In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance. This issue affects: MongoDB Inc. MongoDB Ops Manager 4.0 versions 4.0.9, 4.0.10 and MongoDB Ops Manager 4.1 version 4.1.5.

Why it matters now

EPSS 0.01024 63rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBMongoDB Ops Manager4.0.9; 4.0.10; 4.1.5—No fix listedCNA
  • MongoDB Ops Manager VendorMongoDB Affected 4.0.9; 4.0.10; 4.1.5 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:ops_manager:4.0.9:*:*:*:*:*:*:*4.0.9VulnerableMongoDB
cpe:2.3:a:mongodb:ops_manager:4.0.10:*:*:*:*:*:*:*4.0.10VulnerableMongoDB
cpe:2.3:a:mongodb:ops_manager:4.1.5:*:*:*:*:*:*:*4.1.5VulnerableMongoDB
  • cpe:2.3:a:mongodb:ops_manager:4.0.9:*:*:*:*:*:*:* Versions 4.0.9 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:ops_manager:4.0.10:*:*:*:*:*:*:* Versions 4.0.10 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:ops_manager:4.1.5:*:*:*:*:*:*:* Versions 4.1.5 Vulnerable ·MongoDB

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-2388
  2. 2026-10-03 Alias added: GHSA-5rrm-4j7m-q4w8

References

Other 1

  • TI-2026-07412 Ops Manager RCE via webhook body CVSS 4.0CRITICAL 9.4
  • TI-2020-06410 Potential privilege escalation in Ops Manager API CVSS 3.1HIGH 8.1
  • TI-2026-69857 Uncontrolled resource consumption in MongoDB Ops Manager monitoring endpoints CVSS 4.0MEDIUM 6.9
  • TI-2021-03623 SSL may be unexpectedly disabled during upgrade of multiple-server MongoDB Ops Manager CVSS 3.1MEDIUM 6.7
  • TI-2026-69856 MongoDB Ops Manager exposes pending MFA enrollment seeds in user listings CVSS 4.0MEDIUM 6.0
  • TI-2026-69855 Improper authorization in MongoDB Ops Manager host monitoring retrieval CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences