Description
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MongoDB | Ops Manager | 7.0.0 – ≤ 7.0.23, 8.0.0 – < 8.0.27 | 8.0.27 |