MongoDB Connector for BI Privilege Escalation Vulnerability Due to Improper ACL Management on Windows

A privilege escalation vulnerability exists in the MongoDB Connector for BI, versions 2.0.0 through 2.14.24, installed via MSI on Windows. The vulnerability arises because the application fails to set proper access control lists (ACLs) on custom installation directories, leaving them open to unauthorized modifications. This flaw could potentially be exploited to gain elevated privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing a user to gain elevated rights or access within the system.