CVE-2016-6494

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-10-03 · updated 2026-06-17
Weakness: CWE-200

Description

The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these files.

Affected products

Fedoraproject Fedora: 25
MongoDB: before 3.0.15; from 3.2 before 3.2.14; from 3.3 before 3.3.14 — fixed in 3.0.15, 3.2.14, 3.3.14

How to fix

Upgrade to a fixed version: MongoDB 3.0.15, 3.2.14, 3.3.14. Check the vendor advisory for mitigations.

References

http://www.openwall.com/lists/oss-security/2016/07/29/4
http://www.openwall.com/lists/oss-security/2016/07/29/8
http://www.securityfocus.com/bid/92204
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832908
https://bugzilla.redhat.com/show_bug.cgi?id=1362553
https://github.com/mongodb/mongo/commit/035cf2afc04988b22cb67f4ebfd77e9b344cb6e0
https://jira.mongodb.org/browse/SERVER-25335
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MCE2ZLFBNOK3TTWSTXZJQGZVP4EEJDL/
http://www.openwall.com/lists/oss-security/2016/07/29/4
http://www.openwall.com/lists/oss-security/2016/07/29/8
http://www.securityfocus.com/bid/92204
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832908

Get alerted when CVE-2016-6494 or the next vulnerability affects your stack