CVE-2016-6494

Published: Oct 3, 2016Modified: May 6, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these files.

Affected (4)

Products: Mongodb: Mongodb · Fedoraproject: Fedora

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mongodb Mongodb	Before 3.0.15
Mongodb Mongodb	From 3.2 to 3.2.14
Mongodb Mongodb	From 3.3 to 3.3.14

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 25

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (16)

http://www.openwall.com/lists/oss-security/2016/07/29/4

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/07/29/8

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/92204

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832908

Source: cve@mitre.org

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=1362553

Source: cve@mitre.org

Issue Tracking

https://github.com/mongodb/mongo/commit/035cf2afc04988b22cb67f4ebfd77e9b344cb6e0

Source: cve@mitre.org

Issue TrackingPatch

https://jira.mongodb.org/browse/SERVER-25335

Source: cve@mitre.org

Issue Tracking

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MCE2ZLFBNOK3TTWSTXZJQGZVP4EEJDL/

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2016/07/29/4