MongoDB Windows Installation DLL Hijacking Vulnerability

A vulnerability exists in the MongoDB Windows installation MSI, which may leave Access Control Lists (ACLs) unset on custom installation directories. This flaw allows a local attacker to execute arbitrary code within the MongoDB process through DLL hijacking. The issue is present in MongoDB Server versions 6.0 prior to 6.0.25, 7.0 prior to 7.0.21, and 8.0 prior to 8.0.5.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution within the MongoDB process, potentially allowing an attacker to manipulate MongoDB operations or access sensitive data managed by the database.

Remediation

Users can update to MongoDB Server versions 8.0.5, 7.0.21, or 6.0.25 to address this vulnerability.