← Vulnerability feed

Vulnerability record · CVE-2019-2388 · published 13 May 2020

CVE-2019-2388: Mongodb ops manager vulnerability

Mongodb · Ops Manager

In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance. This issue affects: MongoDB Inc. MongoDB Ops Manager 4.0 versions 4.0.9, 4.0.10 and MongoDB Ops Manager 4.1 version 4.1.5.

5.3 CVSS 3.1 Medium EPSS 1.00% · top 38.7% CWE-425 · CWE-425
5.3CVSS 3.1 base score, v2 5.0
1.00%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance. This issue affects: MongoDB Inc. MongoDB Ops Manager 4.0 versions 4.0.9, 4.0.10 and MongoDB Ops Manager 4.1 version 4.1.5.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-4.0.11
https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-4.0.11

Track CVE-2019-2388 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.4CVE-2026-8431Mongodb ops manager command injection vulnerabilityAn administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specif…EPSS 0.71%6.5CVE-2020-7927Mongodb ops manager vulnerabilitySpecially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. T…EPSS 1.0%4.6CVE-2021-20335Mongodb ops manager cleartext transmission vulnerabilityFor MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB proces…EPSS 0.14%7.5CVE-2024-45195Apache OFBiz forced browsing exposes restricted endpointsApache OFBiz before 18.12.16 is affected by a direct request (forced browsing) flaw, CWE-425, that lets a remote unauthenticated client reach functio…KEVEPSS 100%analysed5.3CVE-2021-26085Atlassian Confluence Server pre-auth arbitrary file read via /s/ endpointConfluence Server and Data Center expose a pre-authorization arbitrary file read through the /s/ endpoint, letting unauthenticated remote attackers v…KEVEPSS 100%analysed

Source: NIST National Vulnerability Database (record CVE-2019-2388), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.