CVE-2024-1351

Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28. Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured.

• CWE-295
• CWE-295

• https://jira.mongodb.org/browse/SERVER-72839Issue Tracking, Patch, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20240524-0010/Third Party Advisory
• https://www.mongodb.com/docs/manual/release-notes/4.4/#4.4.29---february-28--2024Broken Link
• https://www.mongodb.com/docs/manual/release-notes/7.0/#7.0.6---feb-28--2024Release Notes
• https://www.mongodb.com/docs/v5.0/release-notes/5.0/#5.0.25---february-28--2024Release Notes
• https://www.mongodb.com/docs/v6.0/release-notes/6.0/#6.0.14---feb-28--2024Release Notes
• https://jira.mongodb.org/browse/SERVER-72839Issue Tracking, Patch, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20240524-0010/Third Party Advisory
• https://www.mongodb.com/docs/manual/release-notes/4.4/#4.4.29---february-28--2024Broken Link
• https://www.mongodb.com/docs/manual/release-notes/7.0/#7.0.6---feb-28--2024Release Notes
• https://www.mongodb.com/docs/v5.0/release-notes/5.0/#5.0.25---february-28--2024Release Notes
• https://www.mongodb.com/docs/v6.0/release-notes/6.0/#6.0.14---feb-28--2024Release Notes

Published

Mar 7, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-13504The Shared Files – Frontend File Upload Form & Secure File S…7.2
• CVE-2024-13505The Survey Maker plugin for WordPress is vulnerable to Store…4.8
• CVE-2024-13506The GeoDirectory – WP Business Directory Plugin and Classifi…6.4
• CVE-2024-13507The GeoDirectory – WP Business Directory Plugin and Classifi…7.5
• CVE-2024-13508The Booking Package plugin for WordPress is vulnerable to Re…6.1
• CVE-2024-13509The WS Form LITE and PRO plugins for WordPress are vulnerabl…6.1
• CVE-2024-13510The ShopSite plugin for WordPress is vulnerable to Cross-Sit…6.1
• CVE-2024-13511The Variation Swatches for WooCommerce plugin, in all versio…4.3
• CVE-2024-13512The Wonder FontAwesome plugin for WordPress is vulnerable to…5.4
• CVE-2024-13513The Oliver POS – A WooCommerce Point of Sale (POS) plugin fo…9.8
• CVE-2024-13514The B Slider- Gutenberg Slider Block for WP plugin for WordP…4.3
• CVE-2024-13515The Image Source Control Lite – Show Image Credits and Capti…6.1