MongoDB 2.4.x before 2.4.5 and 2.5.x before 2.5.1 allows remote authenticated users to obtain internal system privileges by leveraging a username of __system in an arbitrary database.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mongodb | Mongodb | 2.4.0 (including) | 2.4.0 (including) |
| Mongodb | Mongodb | 2.4.1 (including) | 2.4.1 (including) |
| Mongodb | Mongodb | 2.4.2 (including) | 2.4.2 (including) |
| Mongodb | Mongodb | 2.4.3 (including) | 2.4.3 (including) |
| Mongodb | Mongodb | 2.4.4 (including) | 2.4.4 (including) |
| Mongodb | Mongodb | 2.5.0 (including) | 2.5.0 (including) |
| Mongodb | Ubuntu | lucid | * |
| Mongodb | Ubuntu | precise | * |
| Mongodb | Ubuntu | quantal | * |
| Mongodb | Ubuntu | raring | * |
| Mongodb | Ubuntu | upstream | * |