Read the docs
TI-2020-06407 Aliases CVE-2020-7924GHSA-6cwm-wm82-hgrw

Specific command line parameter might result in accepting invalid certificate

Priority LOW 30CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.

Summary

Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions later than 3.6.5; 3.6 versions prior to 3.6.21; 4.0 versions prior to 4.0.21; 4.2 versions prior to 4.2.11; 100 versions prior to 100.2.0. MongoDB Inc. Mongomirror 0 versions later than 0.6.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00743 54th percentileScored 2026-11-07
Fix Partial MongoDB Database Tools (MongoDB Inc.): 4.0.21, 4.2.11, 100.2.0github.com/mongodb/mongo-tools (Go): 100.2.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBMongoDB Database Tools3.6.5 – 3.6.21; 4.0 to before 4.0.21; 4.2 to before 4.2.11; 100 to before 100.2.04.0.21, 4.2.11, 100.2.0Patch availableCNA
MongoDBMongomirror0.6.0 and later—No fix listedCNA
—github.com/mongodb/mongo-tools (Go)100.0.0 to before 100.2.0100.2.0Patch availableGHSA-6cwm-wm82-hgrw
  • MongoDB Database Tools VendorMongoDB Affected 3.6.5 – 3.6.21; 4.0 to before 4.0.21; 4.2 to before 4.2.11; 100 to before 100.2.0 Fixed in 4.0.21, 4.2.11, 100.2.0 Patch available CNA
  • Mongomirror VendorMongoDB Affected 0.6.0 and later Fixed in — No fix listed CNA
  • github.com/mongodb/mongo-tools (Go) Vendor— Affected 100.0.0 to before 100.2.0 Fixed in 100.2.0 Patch available GHSA-6cwm-wm82-hgrw

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:database_tools:*:*:*:*:*:*:*:*3.6.5 to before 3.6.21; 4.0.0 to before 4.0.21; 4.2.0 to before 4.2.11; 100.0.0 to before 100.2.0VulnerableMongoDB
cpe:2.3:a:mongodb:mongomirror:*:*:*:*:*:*:*:*before 0.6.0VulnerableMongoDB
  • cpe:2.3:a:mongodb:database_tools:*:*:*:*:*:*:*:* Versions 3.6.5 to before 3.6.21; 4.0.0 to before 4.0.21; 4.2.0 to before 4.2.11; 100.0.0 to before 100.2.0 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongomirror:*:*:*:*:*:*:*:* Versions before 0.6.0 Vulnerable ·MongoDB

Remediation

  • Fix · CNA MongoDB Database Tools (MongoDB Inc.) Fixed in 4.0.21, 4.2.11, 100.2.0
  • Fix · GHSA-6cwm-wm82-hgrw github.com/mongodb/mongo-tools (Go) Fixed in 100.2.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Will not fix
Not affected: 1 product
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7924
  2. 2026-10-03 Alias added: GHSA-6cwm-wm82-hgrw

References

Patch 1

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences